LESSONS LEARNED

STS-61C | 1/6/1986 | Crew: 7

SUMMARY:

System configuration errors resulted in inadvertent drain back of 14,000 lbs of LOX prelaunch, which would have resulted in a Trans-Atlantic Abort Landing.

EVENT DESCRIPTION:

On January 6, 1986 during the second launch attempt of STS-61C, the MPS liquid-oxygen inboard fill-and-drain valve was not commanded closed because the liquid-oxygen (LOX) loading automatic sequencer (terminal countdown sequencer / control software) did not receive the closed-switch indication from the replenish valve as required by the prerequisite control logic. This resulted in the automatic sequencer initiating a hold at launch minus 4 minutes 20 seconds. The ground operator verified replenish-valve closure using flowrate and other parameters, but did not close the inboard fill-and-drain valve prior to issuing the resume command to the automatic sequencer at launch minus 2 minutes 55 seconds. This allowed LOX to drain back out of the external tank through the tail service mast vent-and-drain valves until the ground operators noticed the inboard fill-and-drain valve was still open and manually closed the valve. Although unknown at the time, approximately 14,000 to 18,000 lbm of LOX had been inadvertently drained out of the external tank.

Another hold was initiated by ground personnel at launch minus 31 seconds to review the previous out-of-sequence loading termination and obtain a 5-minute liquid-oxygen drain through the main engines. During the hold, the liquid-oxygen main engine temperature dropped below the engine start requirement of 168.3 degrees Rankine by approximately 3 degrees. The engine limit was exceeded because the amount of LOX lost overboard through the fill-and-drain valve caused the colder, more-dense LOX to be drawn in from the external tank. The countdown was recycled to launch minus 20 minutes and oxygen replenish flow was reestablished. The launch was scrubbed when it was determined that the vehicle could not be recycled within the allowable launch window. If the launch had occurred, the reduced LOX quantity in the external tank would have caused early SSME shutdown due to LOX depletion resulting in a Trans-Atlantic Abort Landing (TAL).

Corrective action incorporated in response to this close call included modifications to automatic sequencer software to prevent the prerequisite control logic from blocking LOX inboard fill-and-drain valve close commands, updates to countdown procedures and launch constraints to verify closure of the inboard fill-and-drain valve after replenish valve closure and prior to tail service mast vent-and-drain valve opening, monitoring and initiation of holds if the fill-and-drain valve closed indication is lost, implementation of helium repressurization “pulse purge” if ET ullage pressure drops below 0.25 psi, and verification of minimum ET ullage pressure rise rate at T-120 seconds.

A subsequent launch attempt on January 7, 1986 was scrubbed at the T minus 9 minute hold due to weather constraint violations at TAL sites. However, during post launch scrub operations a broken Ground Support Equipment (GSE) LOX temperature probe was found lodged in SSME #2 pre-valve post-detanking. This temperature probe had failed (off-scale high reading) during LOX loading but due to the absence of any mechanical failure history, the failure was assumed to be electrical in nature and the temperature data from this probe was not mandatory for pre-launch loading operations. The broken temperature probe would have prevented closure of pre-valve during flight, at MECO, resulting in an uncontained SSME failure and possible loss of crew, loss of vehicle.

As a result of the broken GSE LOX temperature probe, all GSE LOX temperature probes were inspected and screened for improper welds, monitored during pre-launch operations for any anomalies, and eventually replaced with redesigned probes. A coarse debris screen was also added upstream of the LOX prevalve to prevent large debris from entering into the prevalve.

SOURCES:

MER Report | Anomaly PR | LO2 Temerature Probe Incident | Mission Report | Close Call

STS-112 | 10/7/2002 | Crew: 6

SUMMARY:

T-0 umbilical issues resulted in none of the system A pyrotechnic charges firing.

EVENT DESCRIPTION:

The post-launch data review of the October 7, 2002 launch determined that none of the system A pyrotechnics (NASA Standard Initiators) for the Solid Rocket Booster hold-down posts nor the External Tank Vent Arm System discharged.

The Master Events Controller (MEC) provided the signal to the Pyrotechnic Initiator Controller (PIC) to discharge the pyrotechnics. Therefore the MEC common wiring, as well as the wiring between the MEC in the orbiter and the PIC rack on the ground, were suspected of not working properly.

All connectors and electrical circuits were inspected and tested, but no root cause was identified to explain the anomaly.

SOURCES:

Apollo 13 | 4/11/1970 | Crew: 3

SUMMARY:

2nd stage center engine shutdown due to pogo oscillations.

EVENT DESCRIPTION:

During the April 11, 1970 launch of Apollo 13 severe pogo oscillations were experienced. Acceleration at the engine attachment reached an estimated 34 g (the accelerometer went out of recordable range) before the engine's combustion chamber low-level pressure sensor commanded an engine shutdown.

SOURCES:

Soyuz 18-1(18a) | 4/5/1975 | Crew: 2 | Loss of Vehicle/Mission

SUMMARY:

Electrical fault caused premature firing of half of the 2nd stage separation bolts, resulting in the inability to fire the remaining ones. Staging failure resulted in abort sequence being used at T=295 seconds.

EVENT DESCRIPTION:

During ascent on April 5, 1975 an electrical malfunction in the Soyuz booster prematurely fired two of the four explosive latches holding the core of the first and second stage together. This severed the electrical connections necessary for firing the remaining two latches. When the core first stage burned out, it could not be cast off as designed.

Ignition of the second stage occurred normally, but the booster was rapidly dragged off course by the weight of the depleted core first stage. When the course deviation reached 10 degrees, the automatic safety system activated, shutting down the booster and separating the Soyuz capsule from the launch vehicle. At the time of separation, the Soyuz was 180 km high and traveling at 5.5 km per second.

The crew endured a 20+ g re-entry and landed in the Altai Mountains. The capsule rolled down a mountain side, and was caught in bushes just short of a precipice. After an hour of waiting in the cold next to the capsule, the crew was discovered by locals speaking Russian.

One crew member suffered internal injuries from the high-g re-entry and downhill fall and never flew again.

SOURCES:

Other SRB Seal Events | Related or Recurring event

SRB gas sealing anomalies have also occurred on:

STS-2 November 12, 1981

STS-6 April 4, 1983

STS-11 (STS-41B) February 3,1984

STS-41C April 6,1984

STS-41D August 30, 1984

STS-51C January 24,1985

STS-51D April 12, 1985

STS-51B April 29, 1985

STS-51G June 17,1985

STS-51F July 29, 1985

STS-51I August 27, 1985

STS-51J October 3, 1985

STS-61A October 30, 1985

STS-61B November 26,1985

STS-61C January 12, 1986

STS-42 January 22, 1992

STS-71 June 27, 1995

STS-70 July 13, 1995

STS-78 June 20, 1996

SOURCES:

STS-51L (Challenger) | 1/28/1986 | Crew: 7 | Loss of Crew | Related or Recurring event

SUMMARY:

SRB seal failure.

EVENT DESCRIPTION:

On January 28, 1986 a combustion gas leak developed in the right solid rocket motor aft field joint shortly after solid rocket booster ignition. The resulting hot gas plume exiting the joint impinged upon the SRB lower attachment strut and adjacent external tank structure weakening the structure to the point of failure.

Seventy-four seconds into flight, the Space Shuttle Challenger broke up.

All seven crew members were lost.

SOURCES:

STS-91 | 6/2/1998 | Crew: 6

SUMMARY:

Main engine pressure chamber sensor failed. If it occurred later, logic error may have triggered at RTLS.

EVENT DESCRIPTION:

After the launch of STS-91 on June 2, 1998, a channel A main engine pressure chamber sensor froze. The sensor was disqualified by engine control software when the sensor exceeded allowable limits during the max Q engine throttle down sequence however the sensor remained qualified for engine redline monitoring since the reading was still within reasonableness limits / operational range for the sensor. The channel B sensor and the main engine performed nominally throughout ascent. If an engine problem had occurred, the channel B sensor would have displayed the correct information and indicated the proper corrective action. However, the channel B sensor would have been ignored due to the frozen channel A sensor.

The post-flight inspection revealed that contamination from a seal leak check caused the sensor to freeze. Marshall Space Flight Center (MSFC) project engineering suggested adding a V-seal leak check prior to the acceptance test, to ensure the newly added V-seal was installed properly. However, MSFC project engineering was unaware that performing the leak check would require the manufacturing personnel to plug the chamber pressure port with Viton. After the flight, the sensor was still plugged with a piece of Viton.

If the main engine pressure chamber sensor froze later in the flight, logic errors may have triggered a premature engine shutdown and a return to the launch site abort. Post-flight software changes were implemented to prevent this from occurring on subsequent flights. Additionally, a one-time flow check verified the reliability of the Lee-Jet for all engines in the fleet. A corrective action requires post-Lee-Jet installation flow check and borescope inspection for future engine builds. Lastly, the V-seal leak check was eliminated in future engine builds.

SOURCES:

Close Call Awareness Paper

STS-110 | 14/8/2002 | Crew: 7

STS-109 | 13/1/2002 | Crew: 7

STS-108 | 12/5/2001 | Crew: 7

SUMMARY:

Incorrect adjustments to the controller software resulted in SSME underperformance.

EVENT DESCRIPTION:

Prior to STS-108 a change had been made to the controller software coefficient for the Space Shuttle Main Engine (SSME) to compensate for an observed measurement bias in the SSME main combustion chamber pressure sensor, which controls the SSME fuel/oxidizer mixture ratio. The pressure chamber sensor was biased high causing the flight software to lower the chamber pressure by decreasing the liquid oxygen flow rate. To correct the high bias a coefficient in the equation was adjusted to compensate. Because of communication errors between ground systems engineers and deficiencies in the flight software verification and validation processes, the software coefficient was adjusted in the wrong direction, resulting in even larger dispersions in the mixture ratio and SSME performance.

The error in the coefficient was discovered during post-flight reconstruction of the data from STS-108. The cause of the error remained unknown until after STS-110. The erroneous coefficient was flown on three consecutive flights (STS-108, STS-109, and STS-110) resulting in a slight SSME underperformance on each flight, and was fixed with the proper coefficient and independent verification prior to STS-111. The error in software and resulting mixture ratio wasn't severe enough to cause any significant impacts to SSME performance, and all three flights achieved proper orbits. However, if the software error had been larger, more severe impacts to the missions and crew safety could have occurred, including a premature engine shutdown/failure resulting in on-pad or ascent abort, loss of mission.

SOURCES:

STS-111 SSME FRR

STS-111 FRR

Close Call Presentation

Other On Pad Aborts | Related or Recurring events

On pad aborts have also occurred on:

STS-51F: On July 12, 1985 the first launch attempt of STS-51F was aborted at T-4.2 seconds. The chamber coolant valve on Space Shuttle Main Engine 2 needed to move from the 100% open setting to the 70% open setting required for startup, but the valve responded slowly. The launch was aborted and the vehicle safely shut down.

STS-55: On March 22, 1993 the third launch attempt of STS-55 was aborted at T-3 seconds when the Space Shuttle Main Engine (SSME) 3 oxidizer preburner purge pressure exceeded the maximum pressure. The monitor detected that the combustion product pressure exceeded the 50 psi redline due to one of the five check valves in the purge system leaking. The launch was aborted and the vehicle safely shut down. All three SSMEs were replaced before the next launch attempt.

STS-51: On August 12, 1993 the first launch attempt of STS-51 was aborted at T-3 seconds because of a disagreement in the turbine fuel flow sensors of Space Shuttle Main Engine (SSME) 2. At 0.6 seconds after ignition SSME 2 experienced a failure of the fuel flow meter channel A2 speed pickup coil sensor (loss of redundancy) to respond to the start transient. The main engine controller used the A and B flow rate measurement data for closed-loop thrust/mixture ratio control, and the failure of either the A or B measurements resulted in lockup of the preset engine mixture ratio. As a result of the failure, the engines were safely shut down. All the main engines were replaced before the next launch attempt.

STS-68: On August 18, 1994 the first launch attempt of STS-68 was aborted at T-1.9 seconds. The abort was triggered after the discharge temperature of the high pressure oxidizer turbopump in Space Shuttle Main Engine (SSME) 3 exceeded the redline temperature, causing the main engine controller to issue a shutdown of SSME 3, followed shortly by the General Purpose Computers issuing a shutdown of the other two engines.

SOURCES:

STS-51F Mission Report

STS-51 Mission Report

STS-55 Mission Report

STS-68 Mission Report

STS-93 | 7/23/1999 | Crew: 5

SUMMARY:

At T+5 a short on AC1 Phase A

resulted in loss of SSME1 Controller A and SSME3 Controller B.

SSME3 H2 leak: early LOX depletion and shutdown.

EVENT DESCRIPTION:

STS-93 encountered two close-call events.

At T+5 seconds a short on AC1 Phase A resulted in the loss of Space Shuttle Main Engine (SSME) 1 Controller A and SSME 3 Controller B.
Approximately five seconds into the launch of STS-93 on July 23, 1999 a momentary short occurred on AC1 phase A. A current spike in excess of 20 amps combined with a voltage drop from 114 to 21 volts alternating current was observed on AC1 phase, phase A. Coincident with the short, the SSME 1 (center) controller A and SSME 3 (right) controller B failed. The short was isolated to a damaged wire in the port wire tray at the mid-body bay. Analysis of the damaged wire indicated the damage resulted from a single mechanical event. It was initially suspected the damage was caused by vibration-induced chaffing against the head of a torque-set screw. At the short location, the screw head showed obvious signs of arcing, and wire damage at a second screw head (about 2 inches away) was observed, but there was no evidence of arcing.
Main Engine 3 hydrogen leak: early liquid oxygen depletion and shutdown.
An early SSME shutdown resulted in a 16 feet per second under speed condition. The early shutdown was traced to a hydrogen leak in the number three main engine nozzle. Post-flight inspection revealed ruptures in the engine nozzle tubes caused by an impact of a loose liquid oxygen post deactivation pin. The liquid hydrogen leak resulted in the controller compensating for fuel loss with additional liquid oxygen flow, at 16 feet per second under speed. The deactivation pin was expelled during the engine start as pressure built in the liquid oxygen cavity (five seconds after engine start). Design changes were implemented to eliminate the need for deactivation pins.

SOURCES:

Apollo 13 | 4/13/1970 | Crew: 3 | Loss of Mission

SUMMARY:

Explosion due to electrical short. Loss of O2 and EPS.

EVENT DESCRIPTION:

Apollo 13 launched on April 11, 1970. On April 13, 1970 during trans-lunar flight at approximately 56 hours, one of the two Service Module oxygen tanks over-pressurized and exploded. This caused the loss of oxygen in that tank and a leak of oxygen out of the remaining tank. This resulted in the loss of all three fuel cells, loss of the primary oxygen source, and the loss of electrical power to the Command Module (except for the entry batteries). The mission was able to continue with the use of the Lunar Module, and the crew safely returned.

Prior to launch, the following conditions resulted in the oxygen tank failing during the mission: By design the cryogenic oxygen tank required both electrical heaters to maintain pressure, and fans to prevent stratification. The tank was a complex assembly with blind installation of the quantity probe, heater/fan assembly, and fill tube. This design leaves wiring insulation vulnerable to damage during assembly with no way to inspect after installation. The Teflon insulated wiring, which is a combustible material in the oxygen tank, was in close proximity to the heater elements and fan.

The Apollo 13 tanks were originally installed on Apollo 11, but a change required the tanks to be removed. During removal of the oxygen shelf, one bolt was left in place causing the fixture to break and resulting in a two-inch drop of the shelf and tanks. Although a loosely fitting (due to loose specification tolerances) fill tube could have been displaced by this, all testing was passed. No cryogenic tests were performed which would have revealed the problem. During the Count Down Demonstration Test the oxygen tank could not be emptied by the normal means of pressurized oxygen gas due to a leak at the fill tube. Instead, the tank heaters were turned on to boil off the oxygen in the tank. The thermostatic switches were rated for 30 volts direct current, but several years earlier the heater ground power supply voltage was raised to 65 volts to reduce the pressurization time. As the temperature increased the thermostatic switch opened and the higher voltage caused the contacts to weld closed. With the heaters continuously on, the temperature approached 1000 degrees and damaged the wire insulation, setting up the conditions for a short and ignition inside the tank. Ground personnel did not notice the continuous heater operation. During the prelaunch problem solving neither the Apollo Spacecraft Program Manager nor the Kennedy Director of Launch Operations knew the tank had previously been dropped or that the heaters had been on for eight hours.

SOURCES:

SpaceShipOne Flight 11P | 10/31/2014 | Crew: 1

SUMMARY:

Left main landing gear collapsed.

EVENT DESCRIPTION:

A nominal landing pattern was flown on December 17, 2003. However, touchdown caused the left main gear to collapse, and the vehicle rolled to a stop off the runway in the soft sand.

SOURCES:

Hypersonic Before the Shuttle

X-15 3-65-97 | 11/15/1967 | Crew: 1 | Loss of Crew

SUMMARY:

Electrical short and crew error led to loss of control at 230,000 feet. First U.S. spaceflight fatality.

EVENT DESCRIPTION:

On November 15, 1967 an electrical short and crew error led to loss of control of the X-15 at 230,000 feet. During re-entry of the vehicle, the aircraft deviated off course due to a combination of the pilot's distraction, misinterpretation of instrumentation display, and possible vertigo. An electrical disturbance that occurred early in the flight had degraded the overall effectiveness of the aircraft's control system and further added to pilot workload. The aircraft entered into a high Mach spin.

The pilot was able to break free from the spin, but the aircraft was in a high-speed inverted dive. While the aircraft was still at sufficient altitude to recover from the dive, the hand controller began forcing the horizontal stabilizers to oscillate. Because of the buffeting in the spin and dive, the pilot likely lost consciousness and the aircraft broke apart.

This was the first United States spaceflight fatality.

SOURCES:

X-15 Inflight Breakup

Micheal J. Adams

Apollo 15 | 8/7/1971 | Crew: 3

SUMMARY:

Landed with only 2 of 3 parachutes.

EVENT DESCRIPTION:

On August 7, 1971 the Apollo capsule, Endeavour, dropped into the Pacific Ocean about 320 miles (515 kilometers) north of Hawaii. During the Earth landing phase, after the main parachutes were deployed and shortly after Reaction Control System (RCS) propellant dumping, one of the main parachutes was observed to be deflated when exiting the clouds (3 of 6 fabric risers failed and two-thirds of the suspension lines were missing). One of the main parachutes was recovered after landing, but the failed parachute was not recovered.

The investigation was divided into three areas which were likely causes of the parachute failure.

The forward heat shield was suspected because of the close proximity to the spacecraft flight path during the period when the failure occurred.

A broken riser/suspension-line connector link was found on the recovered parachute, indicating the possibility of broken links in the failed chute.

The Command Module RCS propellant depletion firing had just been completed, and fuel (monomethyl hydrazine) expulsion was in progress at the time of the failure, indicating the possibility of damage from propellants.

Analysis and testing ruled out possible causes one and two, but a test of raw fuel expulsion after RCS firing produced burning outside of the engine. The flame front extended up to eight feet from the engine exit and unburned fuel was sprayed up to 10 feet from the engine and ignited by burning droplets. This was considered the most likely cause of the parachute failure.

SOURCES:

LUNAR EXPLORATION CONCLUDED: to the Mountains of the Moon

Main Parachute Failure

Crew Debrief

Apollo 15 Anomaly Report

Related or Recurring event

Other Thermal Protection System Damage Events

In addition to the Thermal Protection System (TPS) damage on STS-1, STS-51D, and STS-107, the following Space Shuttle flights experienced TPS damage:

STS-6 (April 1983)

STS-41B (February 1984)

STS-51G (June 1985)

STS-27 (December 1988)

STS-28 (August 1989)

STS-40 (June 1991)

STS-42 (January 1992)

STS-45 (March 1992)

Additional information can be found in the reports linked below.

SOURCES:

STS-6 Mission Report STS-41B MER Report STS-41B Mission Report STS-51G MER Report STS-51G Mission Report STS-27 MER Report STS-27 Mission Report STS-27 Close Call STS-28 Mission Safety Eval Record STS-28 MER Report STS-28 Mission Report STS-40 Debris, Ice, TPS Assessment STS-40 Mission Safety Evaluation STS-40 Mission Report STS-42 Debris, Ice, TPS Assessment STS-42 Mission Report

STS-1 | 4/14/1981 | Crew: 2 | Related or Recurring event

SUMMARY:

Right-hand main landing gear door warped due to entry heating.

EVENT DESCRIPTION:

On April 14, 1981 the right-hand main landing gear door warped due to entry heating. A forward facing step, a tile gap, a tile-to-filler bar gap and an inadequate flow restrictor resulted in excessive gap heating on the forward portion of the right main landing gear door. This excessive heating resulted in severe tile sidewall shrinkage (on four tiles), a charred filler bar, and a localized buckle in the door structure. The structure and Thermal Protection System on the door was refurbished, and the flow restrictor was modified to increase the effectiveness of the Thermal Protection System in the area of the main landing gear doors.

SOURCES:

STS-107 (Columbia) | 2/1/2003 | Crew: 1 | Loss of Crew | Related or Recurring event

SUMMARY:

TPS damage from ascent debris strike resulted in loss of crew and vehicle on entry. Similar bipod ramp foam loss occurred on STS-7, STS-32, STS-50, STS-52, STS-62, and STS-112.

EVENT DESCRIPTION:

Damage to the Thermal Protection System from a debris strike on ascent resulted in the loss of crew and vehicle on entry on February 1, 2003.

At 81.7 seconds Mission Elapsed Time a piece of foam insulation from the External Tank (ET) left bipod ramp separated from the ET and struck the orbiter left wing leading edge in the vicinity of the lower half of reinforced carbon-carbon (RCC) panel #8, causing a breach in the RCC. During re-entry this breach allowed super-heated air to penetrate through the leading edge insulation and progressively melt the aluminum structure of the left wing, resulting in a weakening of the structure until increasing aerodynamic forces caused loss of control, failure of the wing, and break-up of the orbiter. This breakup occurred in a flight regime in which, given the design of the orbiter, there was no possibility for the crew to survive. (Similar bipod ramp foam releases prior to STS-107 occurred on STS-7, STS-32, STS-50, STS-52, STS-62, and STS-112.

Seven crew members were lost.

SOURCES:

Gemini 5 | 8/29/1965 | Crew: 2

SUMMARY:

Erroneous entry data uplinked; crew manually corrected entry flight profile.

EVENT DESCRIPTION:

During entry on August 29, 1965 a crew member used attitude controls to correct the entry flight profile of the vehicle. The computer guiding the capsule was functioning as intended. However, the rotation rate of the Earth was incorrectly entered as 360 degrees per day, instead of the correct 360.98 degrees per day. The crew member recognized the error in the readings and was able to counter the effects. The landing fell 130 kilometers short of the target, but this short landing was closer to the U.S. Navy recovery ship than it would have been if the crew member had not taken action.

SOURCES:

The Covered Wagon

Soyuz 11 | 6/30/1971 | Crew: 3 | Loss of Crew

SUMMARY:

Pyrotechnic system failure resulted in crew module rapid depress.

EVENT DESCRIPTION:

On June 30, 1971 during separation of the orbital and service modules from the descent module, the pyrotechnic system did not operate as intended. All of the pyrotechnics fired simultaneously rather than the designed sequential firing mode. This caused a pressure equalization seal to open in the descent module at a higher-than-designed altitude, resulting in the rapid depressurization of the crew module. The rapid depress led to loss of consciousness of the crew.

All three crew members were lost.

SOURCES:

Descent into the Void

STS-51 | 9/12/1993 | Crew: 5

SUMMARY:

Both port-side primary and secondary SUPER*ZIP explosive cords fired, resulting in containment tube failure and damage in the payload bay.

EVENT DESCRIPTION:

On September 12, 1993 the STS-51 mission commands intended to initiate the primary SUPER*ZIP explosive cord resulted in the simultaneous firing of both the primary explosive cord and back-up explosive cord. This simultaneous explosive cord firing resulted in the rupture of a SUPER*ZIP containment tube and release of contaminants and high-energy debris into the orbiter cargo bay. The orbiter sustained damage to blankets, wire tray covers, the 1307 bulkhead, and Thermal Protection System tiles. If debris had hit critical items it could have resulted in a loss of the orbiter and crew.

SOURCES:

Lessons Learned

STS-95 | 10/29/1998 | Crew: 7

SUMMARY:

Preflight sterilization process chemically altered the Low Iodine Residual System resulting in contaminated drinking water.

EVENT DESCRIPTION:

During STS-95 on October 29, 1998 the preflight sterilization process chemically altered the Low Iodine Residual System (LIRS) resulting in contaminated drinking water.

The crew reported the water from the galley with the LIRS installed had a bad taste. Samples of the water were taken post-flight for analysis. The LIRS was removed. A purge of the LIRS water from the galley plumbing was conducted. After the purge the Galley Iodine Removal Assembly was reinstalled and the crew reported that the water taste was normal after the change-out of hardware.

The bad tasting water could have led to possible crew dehydration due to the crew drinking less water.

SOURCES:

Station Crew Removes Ammonia Pump

ISS Increment 38 | 12/1/2013 | Crew: 6

SUMMARY:

ITCS configuration errors resulted in near freezing and potential rupture of water-to-ammonia heat exchanger.

EVENT DESCRIPTION:

On December 11, 2013 the failure of a flow control valve in the pump module of the External Thermal Control System (ETCS) and subsequent Internal Thermal Control System (ITCS) reconfiguration led to a drop in water temperature to nearly freezing in the Columbus module's Moderate Temperature Heat Exchanger (MTHX). If the water in the Interface Heat Exchanger (IFHX) had frozen, the expansion could have ruptured the barrier between the ITCS and the ETCS. A rupture of this barrier could allow ammonia to enter the interior crew portions of the ISS, causing a potential loss of crew/loss of vehicle.

SOURCES:

Anomaly Log

ITCS Heat Exchanger Close Call Case Study

Close Call Outbrief

STS-114 | 5/26/2006 | Crew: 7

SUMMARY:

Bird strike on External Tank.

Loss of foam from External Tank PAL ramp.

TPS gap filers protruding. Removed during third mission EVA.

Missing O-ring resulted in ejection of one of two NSIs, compromising the ET forward separation bolt function and damaging secondary structure and a thermal blanket.

EVENT DESCRIPTION:

STS-114 encountered four close-call events.

Bird-strike on external tank (ET).
During the July 26, 2005 launch of Discovery on flight STS-114, a vulture soaring around the launch pad impacted the shuttle's ET after liftoff. A bird-strike at a critical point on the shuttle could cause catastrophic damage to the vehicle since the average weight of a vulture is three to five pounds. As a preventative measure, a bird abatement program was implemented to limit the possibility of a future bird-strike on liftoff. One aspect of the program was to remove "roadkill" around the Kennedy Space Center, eliminating an easy food source for vultures. Noise deterrents were tried but had little effect on the vultures. The radar tracking of birds was also implemented.
Loss of foam from External Tank Protuberance Air Load (PAL) ramp.
At T+127.1 seconds foam debris from the ET PAL ramp was seen coming off the ET. The PAL ramps on the liquid hydrogen and liquid oxygen tanks were eliminated on STS-121 and subsequent flights.
Thermal Protection System (TPS) gap fillers protruding. Removed during third extravehicular activity (EVA).
Protruding gap fillers were discovered on the lower forward fuselage during the rendezvous pitch maneuver with the photography of the bottom of the vehicle. Concerns associated with potential early boundary layer tripping and excessive aerodynamic heating during re-entry prompted the decision to remove both gap fillers via EVA. During EVA 3, both gap fillers were successfully removed. Post-flight inspections identified nine additional protruding gap fillers. The gap filler installation process was reviewed and modified.
During post-flight inspection it was discovered that a NASA Standard Initiator (NSI) in one of the two orbiter external tank forward attach shear bolt pressure cartridges had been ejected. Black soot from pyrotechnic combustion residue covered the local surrounding area and a small crack in the secondary structure was observed. The ejected NSI damaged the secondary structure panel (approximately 1 inch long crack) and burned the thermal blankets in the vicinity. The most probable cause of the NSI ejection was a missing O-ring (vendor process escape) between the NSI and pressure cartridge which allowed hot combustion gasses to leak past, erode, and subsequently eject the NSI. The missing O-ring and subsequent combustion gas leakage reduced the probability of successful orbiter external tank forward attachment bolt shear (fracturing was successful). The NSI relies on combustion gas pressure to fracture the forward attach bolt and separate the orbiter from the external tank once on-orbit. Failure to safely separate the orbiter from the external tank would result in loss of crew and vehicle. The ejected NSI could have also damaged the crew cabin pressure shell, located near the forward attach shear bolt, possibly resulting in a cabin air leak requiring an emergency crew return and loss of mission. Mandatory inspection of NSI O-rings during installation / assembly of forward attach shear bolt pressure cartridges was implemented after STS-114.

SOURCES:

STS-41D | 6/26/1984 | Crew: 6 | Related or Recurring event

SUMMARY:

During the launch attempt on June 26, 1984 all aspects of launch countdown were nominal until T-4 seconds when an irregular operation of the Space Shuttle Main Engine (SSME) 3 main fuel valve resulted in an engine shutdown and pad abort condition.

EVENT DESCRIPTION:

The SSME 3 main fuel valve failed to open when commanded and leaked hydrogen for approximately 21 minutes following the shutdown. After the abort, fire was seen on the starboard side of the body flap for approximately 12 minutes. The aft base heat shield water deluge system was activated and was able to extinguish the fire. Damage to the orbiter was mostly confined to the body flap despite invisible flames of burning hydrogen reaching 190 feet.

The Mobile Launcher Platform sustained minor scorching damage to a few purge ducts and one burnt ground wire. The cause of the main fuel valve anomaly was attributed to contamination in the hydraulic actuator that was likely present at time of installation.

Additional inspection and ground tests were implemented to detect valve anomalies prior to installation into flight engines. Real-time monitoring of valve operation prior to engine start was also enhanced, and ultraviolet fire sensors were added.

SOURCES:

Loss of Crew

Crew Injury/Illness and/or Loss of Vehicle or Mission

Related or Recurring event

LAUNCH/GROUND

SUBORBITAL FLIGHTS

RESEARCH FACILITY

ATMOSPHERIC FLIGHTS

LANDING & POSTLANDING

View Test & Verification Entries

Hide Test & Verification Entries

Events in which system design margin, or lack thereof, prevented or could have prevented loss of crew or loss of mission. System design should include design margin to account for uncertainties in natural and induced environments, material properties, system dispersions / performance. It should also provide some ability for the integrated system to tolerate failures/degradation without catastrophic effect.

Loss of Crew

Crew Injury/Illness and/or Loss of Vehicle or Mission

Related or Recurring event

TPS Entry Events

(1981-2003)

Fire/Overheating Events

(1971-2008)

Service/Descent Module Separation Failures

(1961-2008)

Ascent Debris:

Other debris events have occurred on:

Late Release Orbiter Tyvek Covers

(1981-96)

SRB Seal Events

*toxic byproducts released

Soyuz TM-9

2/11/1990

STS-51L (Challenger)

1/28/1986

Other SRB gas seal anomalies:

STS-2, 6, 41B, 41C, 41D, 51C, 51D, 51B, 51G, 51F, 51I, 51J, 61A, 61B, 61C, 42, 70, 71, 78

STS-1

4/12/1981

STS-114

5/26/2006

STS-93

7/23/1999

STS-124

5/31/2008

STS-95

10/29/1998

STS-116 and STS-125

STS-114, 115, 118, 119,
124, 126

STS-99

2/2000

Apollo 11

7/21/1969

Soyuz 33

4/12/1979

Soyuz 21

8/24/1976

Soyuz 1

4/23/1967

Gemini 8

3/16-17/1966

Mir, 10/94, Crew: 6

Soyuz TM-5

9/6/1988

Soyuz TMA-11 (15S)

4/19/2008

Soyuz TMA-10 (14S)

10/21/07

Crew: 3

Soyuz 5

1/18/69

Crew: 2

Voskhod 2

3/19/65

Crew: 1

Vostok 5

6/19/63

Crew: 1

Vostok 2

8/7/61

Crew: 1

Vostok 1

4/12/61

Crew: 1

STS-107 (Columbia)

2/1/2003

STS-51D

4/19/1985

STS-1

4/14/1981

Other significant STS TPS anomalies:

STS-6, 41B, 51G, 27*, 28, 40. 42, 45

*Most severe tile damage to date.

STS-134

6/1/2011

STS-51D

4/19/1985

STS-9

12/8/1983

Apollo 12

11/24/1969

SpaceShipOne

Flight 11P

12/17/2003

STS-1 | 4/12/1981 | Crew: 2

SUMMARY:

SRB ignition pressure wave caused TPS and structural damage.

EVENT DESCRIPTION:

During the April 12, 1981 launch of STS-1, a higher than expected solid rocket booster ignition pressure wave caused damage to both the thermal protection system and structure.

SOURCES:

Other SRB Seal Events | Related or Recurring event

SRB gas sealing anomalies have also occurred on:

STS-2 November 12, 1981

STS-6 April 4, 1983

STS-11 (STS-41B) February 3,1984

STS-41C April 6,1984

STS-41D August 30, 1984

STS-51C January 24,1985

STS-51D April 12, 1985

STS-51B April 29, 1985

STS-51G June 17,1985

STS-51F July 29, 1985

STS-51I August 27, 1985

STS-51J October 3, 1985

STS-61A October 30, 1985

STS-61B November 26,1985

STS-61C January 12, 1986

STS-42 January 22, 1992

STS-71 June 27, 1995

STS-70 July 13, 1995

STS-78 June 20, 1996

SOURCES:

STS-51L (Challenger) | 1/28/1986 | Crew: 7 | Loss of Crew | Related or Recurring event

SUMMARY:

SRB seal failure.

EVENT DESCRIPTION:

Seventy-four seconds into flight, the Space Shuttle Challenger broke up.

All seven crew members were lost.

SOURCES:

Soyuz TM-9 | 2/11/1990 | Crew: 2

SUMMARY:

DM insulation torn loose on ascent; contingency EVA repair.

EVENT DESCRIPTION:

During the docking of Soyuz TM-9 on February 11, 1990, the TM-8 crew aboard Mir noticed three of the eight descent module's thermal blankets had partially detached near the heat shield during ascent. This raised five concerns:

If the capsule cooled down, it would allow condensation to form inside the capsule and cause electrical systems to fail.
The partially detached blankets could interfere with the infrared vertical sensor which is required to orient the module for re-entry.
Exposure to space could cause a failure of the explosive bolts that bind the service module to the descent module.
The heat shield could be compromised by direct space exposure.
An Extravehicular Activity (EVA) to repair the blankets could inflict further damage.

A rescue mission with a cosmonaut aboard Soyuz-TM 10 was considered, but not executed. The temperature of TM-9 was stabilized by the Mir directing it into alignment with the sun.

Four months later, the Kristall module (90-048A) arrived with the special tools needed to repair the decent module. Cosmonauts were able to secure the blankets out of the sensor's line of sight after an EVA longer than seven hours. The success of the EVA led to a nominal entry upon mission completion.

SOURCES:

STS-93 | 7/23/1999 | Crew: 5

SUMMARY:

At T+5 a short on AC1 Phase A

resulted in loss of SSME1 Controller A and SSME3 Controller B.

SSME3 H2 leak: early LOX depletion and shutdown.

EVENT DESCRIPTION:

STS-93 encountered two close-call events.

At T+5 seconds a short on AC1 Phase A resulted in the loss of Space Shuttle Main Engine (SSME) 1 Controller A and SSME 3 Controller B.
Approximately five seconds into the launch of STS-93 on July 23, 1999 a momentary short occurred on AC1 phase A. A current spike in excess of 20 amps combined with a voltage drop from 114 to 21 volts alternating current was observed on AC1 phase, phase A. Coincident with the short, the SSME 1 (center) controller A and SSME 3 (right) controller B failed. The short was isolated to a damaged wire in the port wire tray at the mid-body bay. Analysis of the damaged wire indicated the damage resulted from a single mechanical event. It was initially suspected the damage was caused by vibration-induced chaffing against the head of a torque-set screw. At the short location, the screw head showed obvious signs of arcing, and wire damage at a second screw head (about 2 inches away) was observed, but there was no evidence of arcing.
Main Engine 3 hydrogen leak: early liquid oxygen depletion and shutdown.
An early SSME shutdown resulted in a 16 feet per second under speed condition. The early shutdown was traced to a hydrogen leak in the number three main engine nozzle. Post-flight inspection revealed ruptures in the engine nozzle tubes caused by an impact of a loose liquid oxygen post deactivation pin. The liquid hydrogen leak resulted in the controller compensating for fuel loss with additional liquid oxygen flow, at 16 feet per second under speed. The deactivation pin was expelled during the engine start as pressure built in the liquid oxygen cavity (five seconds after engine start). Design changes were implemented to eliminate the need for deactivation pins.

SOURCES:

STS-95 | 10/29/1998 | Crew: 7 | Related or Recurring event

SUMMARY:

Drag chute door separated during launch and impacted main engine bell.

EVENT DESCRIPTION:

On October 29, 1998 during the main engine ignition sequence, the drag chute panel fell away from the vehicle. Video of the launch confirmed the drag chute door detached three seconds prior to liftoff and hit the engine nozzle of Space Shuttle Main Engine (SSME) 1.

The remains of the door were found during a post-launch pad inspection, revealing that at least one aluminum shear pin used to attach the door sheared. The root cause of the shearing was a combination of the high pressure environment caused by SSME ignition and a low margin hinge pin. The drag chute door struck the nozzle of the center main engine but did not do any appreciable damage to the engine or vehicle. Concerns about the status and condition of the chute contained in the drag chute compartment resulted in the decision not to deploy the chute during landing.

As a precautionary measure, two subsequent missions used a solid closeout panel bolted over the drag chute compartment and did not utilize the drag chute. All flights following these missions used Inconel instead of aluminum as shear pin material.

SOURCES:

STS-95 Mission Archives

STS-114 MER Report | STS-115 MER Report | STS-118 Debris Report

STS-116 | 12/10/2006 | Related or Recurring event

STS-125 | 15/11/2009 | Related or Recurring event

Debris from the flight vehicle or the launch facility poses a risk to all crewed space launches.

Other significant ascent debris events have occurred on:

STS-116:

On December 10, 2006, during ascent, booster trowelable ablative (BTA) around the solid rocket booster (SRB) left hand aft booster separation motor (BSM) nozzle liberated and was seen striking the bottom of the orbiter shortly after SRB separation began. The root cause of the observed debris liberation was determined to be stress buildup in the thermal protection system (TPS) and BTA closeout configuration at the aft BSM exit cone. The failure mechanism that produced the forward transport of the BTA was a hinging effect on the liberated BTA coupled with plume expansion at altitude, which projected the debris forward to where it struck the orbiter.

The BTA closeouts around the aft BSM nozzles were modified to eliminate the failure mechanism that caused the forward debris transport as well as limit the size and release angle of BTA liberated at SRB separation.

STS-125:

On May 11, 2009 during ascent the Wing Leading Edge Impact Detection System (WLEIDS) recorded two impacts on the starboard chine, which was confirmed by video imagery analysis.

Damage detected during on-orbit inspection was below the damage tolerance threshold.

SOURCES:

STS-116 Debris Report | STS-116 IDBR-01 | STS-125 Debris Report | STS-125 MER Report | STS-125 Mission Report

Late Release Orbiter Tyvek Covers

During the ascent phase of:

STS-114 | 7/26/2005

STS-115 | 9/9/2006

STS-118 | 8/8/2007

STS-119 | 3/15/2009

STS-124 | 7/31/2008

STS-126 | 11/14/2008

The Tyvek covers for the reaction control system jets released later than intended. The late release resulted in the Tyvek reaching a higher velocity than designed, thus posing a higher risk of damage to the orbiter.

Tyvek covers were used to keep rain water and other debris out of the reaction control system jets while the shuttle was on the launch pad.

SOURCES:

STS-119 MER Report | STS-124 MER Report | STS-124 Debris Report

STS-126 MER Report

Apollo 11 | 7/21/1969 | Crew: 2

SUMMARY:

Engine arm circuit breaker knob broke off. Circuit breaker successfully reset allowing ascent.

EVENT DESCRIPTION:

On July 21, 1969 while preparing for extravehicular activities, the engine arm circuit breaker broke, probably due to an impact from the oxygen purge system. A felt tipped pen was used to successfully depress the circuit breaker when needed. Circuit breaker guards were installed on Apollo 12 and subsequent vehicles to prevent the oxygen purge system from impacting the circuit breakers.

SOURCES:

Investigative findings backed by nominal Soyuz TMA-13 return

Soyuz TMA-11 (15S) | 4/19/2008 | Crew: 3 | Crew Injury (1) | Related or Recurring event

SUMMARY:

Ballistic, high g entry and landing over 400 km short of intended target.

EVENT DESCRIPTION:

During Soyuz TMA-11 entry on April 19, 2008, the Soyuz instrumentation and propulsion module (IPM) failed to properly separate from the descent module (DM). This resulted in a ballistic entry, higher g loads during descent, and the spacecraft landing more than 400 km short of the intended target. The abnormal entry attitude(hatch-forward) during early descent caused excessive heating on the hatch and back shell of the descent module. The recovery team's arrival at the landing site was delayed by approximately 45 minutes due to the off-target landing. One crew member was later hospitalized because of injuries sustained during entry and landing.

A Russian investigation into the cause of the DM/IPM separation system failure concluded that one of the five pyrotechnically actuated locks, which attach the Soyuz instrumentation and propulsion module to the descent module, failed to release at the proper time.

SOURCES:

Investigative findings backed by nominal Soyuz TMA-13 return

Soyuz TMA-10 (14S) | 10/21/2007 | Crew: 3 | Related or Recurring event

EVENT DESCRIPTION:

During Soyuz TMA-10 entry on October 21, 2007, the Soyuz instrumentation and propulsion module (IPM) failed to properly separate from the descent module (DM). This resulted in a ballistic entry. The abnormal entry attitude(hatch-forward) during early descent caused excessive heating on the hatch and back shell of the descent module.

SOURCES:

Soyuz 5 | 1/18/1969 | Crew: 2 | Related or Recurring event

EVENT DESCRIPTION:

During entry procedures on January 18, 1969 the connecting latches between the Descent Module (DM) and the Service Module (SM) of the Soyuz spacecraft failed to separate at the intended time as designed. The failure to separate led the Soyuz to undergo a “nose first” entry. During the entry, layers of the descent module shell peeled away due to heating and internal pressure. As a result of the heating, the connections between the DM and SM were broken and allowed the DM to return to the normal orientation. The DM survived the unplanned heating in the unshielded areas of the capsule.

SOURCES:

Soyuz 5's Flaming Return

Voskhod 2 | 3/19/1965 | Crew: 1 | Related or Recurring event

EVENT DESCRIPTION:

On March 19, 1965 a communication cable connecting the landing module with the orbital module failed to separate at the appropriate time, causing the two modules' common center of gravity to shift, causing the two modules to begin spinning around it. The spinning eventually stopped at an altitude of about 100 kilometers, when the connecting cable burned through and the landing module slipped free.

SOURCES:

The Nightmare of Voskhod 2

Vostok 5 | 6/19/1963 | Crew: 1 | Related or Recurring event

EVENT DESCRIPTION:

On June 19, 1963 the Vostok service module failed to separate cleanly from the re-entry sphere resulting in wild gyrations until the heat of re-entry burned through the non-separating retraining strap.

SOURCES:

Vostok 5

Vostok 2 | 8/7/1961 | Crew: 1 | Related or Recurring event

EVENT DESCRIPTION:

On August 7, 1961 during entry it was discovered that lights on the control console in the cabin, which were powered from the instrument module, remained on. Because the lights were on, it was thought that separation of the two modules had not happened. However, the separation between the capsule and the instrument compartment had taken place. A multi-cable umbilical line between two compartments apparently failed to cut off. This likely explains why the crew member heard the separation jolt, but did not see the control lights go out. The electric current was still flowing to the control panel via umbilical cables. The two modules eventually separated when the cable burned through during entry.

SOURCES:

Vostok 2

Vostok 1 | 4/12/1961 | Crew: 1 | Related or Recurring event

EVENT DESCRIPTION:

On April 12, 1961 ten seconds after retrofire, commands were sent to separate the Vostok service module from the re-entry module. The Vostok equipment module unexpectedly remained attached to the re-entry module by a bundle of wires. The two halves of the spacecraft began entry and experienced strong gyrations as Vostok 1 crossed over Egypt. At this point in the entry profile the wires connecting the modules broke, causing the two modules to separate. After the separation of the two modules, the descent module settled into the proper entry attitude and landed as intended.

SOURCES:

The Flight of Vostok 1

Related or Recurring event

In addition to three overheating/fire events on the ISS and two significant events on Mir in 1997 and 1998, other overheating/fire events also occurred on:

Mir (October 1994) (A)

STS-40 (June 1991) (B)

STS-35 (December 1990) (C)

STS-28 (August 1989) (D)

STS-6 (April 1983) (E)

Salyut 7 (September 1982) (F)

Salyut 6 (1979) (G)

Salyut 1 (June 1971) (H)

SOURCES:

SpaceShipOne Flight 11P | 10/31/2014 | Crew: 1

SUMMARY:

Left main landing gear collapsed.

EVENT DESCRIPTION:

A nominal landing pattern was flown on December 17, 2003. However, touchdown caused the left main gear to collapse, and the vehicle rolled to a stop off the runway in the soft sand.

SOURCES:

Apollo 12 | 11/24/1969 | Crew: 3

SUMMARY:

Harder than normal splashdown knocked loose a camera. The camera knocked lunar module pilot unconscious.

EVENT DESCRIPTION:

Due to a harder than normal splashdown on November 24, 1969, a camera broke free from the window bracket and struck the lunar module pilot on the forehead. The crew member was unconscious for five seconds after the injury and required sutures following retrieval.

SOURCES:

Technical Debrief

STS-9 | 12/8/1983 | Crew: 6

SUMMARY:

A. Two APUs caught fire during rollout.

B. GPC failed on touchdown.

C. Incorrect flight control rechannelization on rollout.

EVENT DESCRIPTION:

A) During rollout on December 8, 1983 two Auxiliary Power Units (APUs) caught fire. Six minutes and fifty seconds after the orbiter landed, APU-1 shut down automatically due to a turbine-underspeed condition. Four minutes and twenty-four seconds later, a detonation occurred in APU-1, along with simultaneous automatic shutdown of APU-2, also the result of a turbine-underspeed condition. Fourteen minutes and forty-two seconds after APU-2 shutdown, a detonation occurred on APU-2. Post-flight examination of the orbiter aft compartment revealed fire damage to both APUs and minor shrapnel damage. Post-flight analysis indicated that both APU failures were the result of stress-corrosion cracking in the injector stems of both APUs, which resulted in leakage of hydrazine and subsequent fire/explosion events. The injector stems were subsequently redesigned to reduce susceptibility to corrosion by chromizing the stem, and to reduce material stresses by making changes in the installation processes.

B) Also during landing on December 8, a General Purpose Computer (GPC) failed on touchdown and an incorrect flight control rechannelization occurred on rollout. Due to a failure on orbit, GPC 1 was powered down prior to entry (creating an off-nominal configuration), and the remaining GPCs (2, 3, 4, and 5) were configured for entry landing. During landing rollout, GPC 2, which had previously failed on orbit but was recovered prior to entry, failed again at nose-wheel slap down.

C) The crew reacted with procedures for computer loss in a nominal configuration with GPC 1 active and nominal Flight Control System channel assignments. The crew's execution of GPC 2 malfunction procedures in this off-nominal GPC string configuration resulted in the loss of the remaining two redundant flight control strings. This was not a problem on the runway, but could have resulted in loss of control in flight.

SOURCES:

STS-51D | 4/19/1985 | Crew: 7

SUMMARY:

Right brake failed (locked up) causing blowout of inboard tire and significant damage to outboard tire.

Crew: 7

EVENT DESCRIPTION:

On April 19, 1985 the right brake on the orbiter failed, causing the blowout of an inboard tire and significant damage to an outboard tire. A crosswind of about 8 knots, gusting up to 12, resulted in extra brake energy on the right brake while returning to and holding the runway centerline during rollout. The number 3 stator on both the inboard and outboard right main landing gear (MLG) brakes broke into several pieces, causing both brakes to lock during rollout. The inboard right brake locked at 20.6 knots and 113 feet, before the orbiter stopped and the outboard right brake locked for the last 5 feet of rollout. The right MLG inboard tire burst 33 feet after the inboard brake locked. Eleven of 16 cord layers were worn through before the tire burst. The right MLG brakes failed and locked due to thermal soak-back when the number 3 stators broke.

The corrective action includes the following standard procedures to prevent heat soak-back:

1. Brake-on velocity between 140 and 120 knots.

2. Deceleration rate between 8 and 10 ft/sec2.

3. Deceleration rate reduced to 6 ft/sec2 at 40 knots. If brake-on velocity exceeds 140 knots, continue 8 to 10 ft/sec2 deceleration.

SOURCES:

STS-137 | 6/1/2011 | Crew: 7

SUMMARY:

Brief fire observed between the left main landing gear tires during runway rollout.

EVENT DESCRIPTION:

STS-134 landed on June 1, 2011. During analysis of the post-landing imagery, a fire was briefly observed during the rollout period, located between the left Main Landing Gear tires shortly after the drag chute was jettisoned. Detailed visual inspections, material analysis, and landing gear systems tests were performed in an effort to determine the root cause of the fire. However, no definitive root cause could be determined. The fire may have been operational, because the commander applied the brakes in excess of recommended deceleration rates, especially at the lower speeds, resulting in the shortest landing rollout on a concrete runway surface since the drag chute had been used. The excessive braking may have generated higher than normal temperatures within the brake.

SOURCES:

Related or Recurring event

Other Thermal Protection System Damage Events

In addition to the Thermal Protection System (TPS) damage on STS-1, STS-51D, and STS-107, the following Space Shuttle flights experienced TPS damage:

STS-6 (April 1983)

STS-41B (February 1984)

STS-51G (June 1985)

STS-27 (December 1988)

STS-28 (August 1989)

STS-40 (June 1991)

STS-42 (January 1992)

STS-45 (March 1992)

Additional information can be found in the reports linked below.

SOURCES:

STS-1 | 4/14/1981 | Crew: 2 | Related or Recurring event

SUMMARY:

Right-hand main landing gear door warped due to entry heating.

EVENT DESCRIPTION:

SOURCES:

STS-51D | 4/19/1985 | Crew: 7 | Related or Recurring event

SUMMARY:

TPS burn-through on left outboard elevon.

EVENT DESCRIPTION:

The post-flight inspection of the Thermal Protection System (TPS) revealed that significant damage occurred during landing on April 19, 1985.

The outboard end of the left-hand lower outboard elevon had received significant heat damage, specifically the outboard forward corner of the elevon lower-honeycomb outer-face-sheet. This area was buckled and delaminated and had two small burn-through holes. The outboard elevon lower-leading-edge tile-carrier panel was completely melted under the outboard tile, and a hole was melted in the elevon-cove primary-seal support plate. Because of the damage the lower-outboard carrier-panel outermost tile fell onto the runway when the elevon was deflected upward after landing.

Evidence indicates that the entry plasma flow entered the inboard gap of the outboard tile, then progressed under the tile flowing outboard, where eventually the tile-attachment strain isolation pad was burned, allowing the tile to become loose. This allowed more plasma flow under the tile, resulting in the melting of the aluminum carrier panel, primary seal panel structure, and elevon honeycomb outer face sheet, as well as the melting of two tiles aft of the plasma entry point and two elevon sidewall tiles. The cause of the TPS and structural damage that occurred during descent has not been positively identified. The most probable cause is an out-of-spec step or gap in the lower wing surface forward of the elevon leading edge. It is believed that this flow path may have existed for the two previous flights, with progressive deterioration of the bond, but was not evident from outside inspection of this area during post-flight inspections.

A requirement was established to remove the outboard leading-edge carrier-panel on each side of all orbiters for detailed inspection after the next several flights. In addition, a more comprehensive detailed inspection of each outboard elevon/wing area was accomplished during the normal TPS post-flight inspections.

SOURCES:

STS-107 (Columbia) | 2/1/2003 | Crew: 1 | Loss of Crew | Related or Recurring event

SUMMARY:

TPS damage from ascent debris strike resulted in loss of crew and vehicle on entry. Similar bipod ramp foam loss occurred on STS-7, STS-32, STS-50, STS-52, STS-62, and STS-112.

EVENT DESCRIPTION:

Damage to the Thermal Protection System from a debris strike on ascent resulted in the loss of crew and vehicle on entry on February 1, 2003.

Seven crew members were lost.

SOURCES:

Soyuz TM-5 | 9/6/1988 | Crew: 2

SUMMARY:

Two de-orbit attempts failed. Crew confined to DM due to OM being jettisoned prior to 1st de-orbit attempt. Crew prevented erroneous firing of SM separation pyrotechnics.

EVENT DESCRIPTION:

Two de-orbit burn attempts failed and nearly led to the loss of the crew. The crew was confined to the descent module due to the orbital module being jettisoned prior to the first deorbit attempt. The first deorbit burn was prevented by a sensor glitch which disappeared after seven minutes, and then the burn started. However, the crew manually shut down the burn after three seconds.

A second burn two revolutions later occurred on time for six seconds, then stopped, and the crew manually restarted the burn. However, after an additional 60 seconds it was cut off by the autopilot. The crew manually interrupted the command sequence shortly before the descent/equipment module separation pyros were to have been fired, preventing an erroneous firing. The main cause of the crew's problems was acknowledged to be a combination of incorrect actions of the crew commander and mission control personnel.

SOURCES:

Gemini 8 | 3/16-3/17/1966 | Crew: 2 | Emergency De-orbit | Loss of Mission

SUMMARY:

Stuck thruster caused loss of control and led to 1st U.S. emergency
de-orbit.

EVENT DESCRIPTION:

During the Gemini 8 flight from March 16 – 17, 1966 a stuck thruster, number 8, which controls roll, caused a loss of control and rapid spin rate of the capsule that could have led to the crew losing consciousness. To counter the effects the stuck thruster was turned off and the re-entry control system had to be used to stabilize the capsule. Use of the re-entry control system led the Gemini safety group to declare an end to the mission, which led to the first United States emergency de-orbit. The thruster apparently short circuited while attached to the Agena target vehicle.

SOURCES:

Soyuz 1 | 4/23/1967 | Crew: 1 | Loss of Mission

SUMMARY:

Failures in attitude control and electrical power systems resulted in a loss of mission. The launch of the intended docking target, Soyuz 2, was scrubbed.

EVENT DESCRIPTION:

After achieving orbital insertion on April 23, 1967 the left solar array of the Soyuz 1 spacecraft did not deploy, causing the spacecraft to receive only half of the planned solar power. Despite the solar array failure, the crew member attempted to maneuver the spacecraft. The attempt was unsuccessful because of interference between the reaction control system exhaust and the ion flow sensors.

The failure of the solar array to deploy also prevented the cover of the sun and star sensor from opening, preventing attitude control for crucial maneuvers such as spin stabilization and engine firings. The failures on Soyuz 1 prevented the launch of Soyuz 2, which had been scheduled to rendezvous and dock with Soyuz 1, causing the Soyuz 1 mission to be ended early.

Due to the failures with the control systems, the cosmonaut had to manually control the spacecraft for the critical de-orbit burn and entry while also managing the power supply of the crippled vehicle. (See also Soyuz 1 entry event)

SOURCES:

Soyuz 21 | 8/24/1976 | Crew: 2

SUMMARY:

Separation from Salyut failed; ground command succeeded in opening latches.

EVENT DESCRIPTION:

On August 24, 1976 separation from Salyut failed. Prior to the latches being fully open, the latches gave a false 'open' indication, leading to the premature firing of the Soyuz separation thrusters and jamming the latches partially open. The Soyuz remained loosely attached to the station until ground control was able to send commands to the latches, forcing them open.

SOURCES:

Soyuz 33 | 4/12/1979 | Crew: 2 | Loss of Mission

SUMMARY:

Main engine anomaly caused final rendezvous abort.

EVENT DESCRIPTION:

On April 12, 1979 during docking attempts the crew aboard Salyut 6 reported flames shooting sideways from the main engine, toward the backup engine, at the time of the shutdown. The docking was canceled and the Soyuz crew prepared to return to Earth. (See Soyuz 33 entry event)

SOURCES:

Soyuz 33

STS-99 | 2/2000 | Crew: 6

SUMMARY:

High bacterial count in postflight sample after GIRA installed to removed iodine.

EVENT DESCRIPTION:

During the February 2000 flight, a high bacterial count of 160 colony forming units (CFUs)per 100 ml was discovered in a post-flight sample after the Galley Iodine Removal Assembly was installed to remove iodine. The level should have been less than 100 CFUs/100 ml.

SOURCES:

Kennedy Space Center Annual Report FY2008

STS-124 | 5/31/2008 | Crew: 7 | Related or Recurring event

SUMMARY:

Pad 39-A flame trench suffered significant damage causing about 3,500 refractory bricks to be blown away from the flame trench wall.

EVENT DESCRIPTION:

On May 31, 2008 during the launch of STS-124, the Pad 39-A flame trench suffered significant damage causing about 3,500 refractory bricks to be blown away from the flame trench wall. The bricks scattered away from the flame trench beyond the pad perimeter fence. This debris could have damaged the vehicle or the launch complex.

Pad generated debris is a concern for any spaceflight, due to the potential for debris to travel in a manner that can damage the vehicle or the launch complex.

SOURCES:

Spray-on Layer to Protect Flame Trench

Debris Assessment Report

STS-114 | 5/26/2006 | Crew: 7

SUMMARY:

Bird strike on External Tank.

Loss of foam from External Tank PAL ramp.

TPS gap filers protruding. Removed during third mission EVA.

Missing O-ring resulted in ejection of one of two NSIs, compromising the ET forward separation bolt function and damaging secondary structure and a thermal blanket.

EVENT DESCRIPTION:

STS-114 encountered four close-call events.

Bird-strike on external tank (ET).
During the July 26, 2005 launch of Discovery on flight STS-114, a vulture soaring around the launch pad impacted the shuttle's ET after liftoff. A bird-strike at a critical point on the shuttle could cause catastrophic damage to the vehicle since the average weight of a vulture is three to five pounds. As a preventative measure, a bird abatement program was implemented to limit the possibility of a future bird-strike on liftoff. One aspect of the program was to remove "roadkill" around the Kennedy Space Center, eliminating an easy food source for vultures. Noise deterrents were tried but had little effect on the vultures. The radar tracking of birds was also implemented.
Loss of foam from External Tank Protuberance Air Load (PAL) ramp.
At T+127.1 seconds foam debris from the ET PAL ramp was seen coming off the ET. The PAL ramps on the liquid hydrogen and liquid oxygen tanks were eliminated on STS-121 and subsequent flights.
Thermal Protection System (TPS) gap fillers protruding. Removed during third extravehicular activity (EVA).
Protruding gap fillers were discovered on the lower forward fuselage during the rendezvous pitch maneuver with the photography of the bottom of the vehicle. Concerns associated with potential early boundary layer tripping and excessive aerodynamic heating during re-entry prompted the decision to remove both gap fillers via EVA. During EVA 3, both gap fillers were successfully removed. Post-flight inspections identified nine additional protruding gap fillers. The gap filler installation process was reviewed and modified.
During post-flight inspection it was discovered that a NASA Standard Initiator (NSI) in one of the two orbiter external tank forward attach shear bolt pressure cartridges had been ejected. Black soot from pyrotechnic combustion residue covered the local surrounding area and a small crack in the secondary structure was observed. The ejected NSI damaged the secondary structure panel (approximately 1 inch long crack) and burned the thermal blankets in the vicinity. The most probable cause of the NSI ejection was a missing O-ring (vendor process escape) between the NSI and pressure cartridge which allowed hot combustion gasses to leak past, erode, and subsequently eject the NSI. The missing O-ring and subsequent combustion gas leakage reduced the probability of successful orbiter external tank forward attachment bolt shear (fracturing was successful). The NSI relies on combustion gas pressure to fracture the forward attach bolt and separate the orbiter from the external tank once on-orbit. Failure to safely separate the orbiter from the external tank would result in loss of crew and vehicle. The ejected NSI could have also damaged the crew cabin pressure shell, located near the forward attach shear bolt, possibly resulting in a cabin air leak requiring an emergency crew return and loss of mission. Mandatory inspection of NSI O-rings during installation / assembly of forward attach shear bolt pressure cartridges was implemented after STS-114.

SOURCES:

LAUNCH/GROUND

SUBORBITAL FLIGHTS

RESEARCH FACILITY

ATMOSPHERIC FLIGHTS

LANDING & POSTLANDING

View Design Margin Entries

Hide Design Margin Entries

Events in which crew training and human/system interface design either:

- allowed mission to continue or mitigated risk to crew safety

- compromised crew safety and mission success (e.g., human errors or inadequate training or human/system interface)

Flight and ground crew should be properly trained for nominal and off-nominal operations. Human factors should be considered and incorporated into the system design to mitigate risk of crew errors. Physical and physiological effects of space on crew members should also be factored into the design and operational plans for new crewed spaced systems and missions.

Loss of Crew

Crew Injury/Illness and/or Loss of Vehicle or Mission

Related or Recurring event

Mir Collision Events

1994-1997

Docking Anomalies

STS-61C

1/6/1986

X-15 3-65-97

11/15/1967

SpaceShipOne 16P

9/29/2004

SpaceShipOne 14P

5/13/2004

ISS Increment 38

12/1/2013

Soviet Altitude

Chamber O2 Fire

3/23/1961

STS-87

Mir

7/17/1997

STS-32

1/9/1990

Soyuz 33

4/12/1979

Gemini 8

3/16-17/1966

Mercury MA-9

5/16/1963

Apollo 10

5/22/1969

Skylab 2

5/26/1973

Soyuz 10

4/23/1971

Mir

6/25/1997

Mir

8/30/1994

Mir

1/14/1994

M21-D21

7/30/1966

SpaceShipTwo, PF04

10/31/2014

Soyuz TM-5

9/6/1988

Skylab 4

2/8/1974

Gemini 5

8/29/1965

Voskhod 2

3/19/1965

STS-134

6/1/2011

STS-108

12/7/2001

STS-90

5/3/1998

STS-37

4/11/1991

STS-9

12/8/1983

Apollo ASTP

7/24/1975

STS-3

3/30/1982

Mercury MA-7

5/24/1962

Mercury MR4

7/21/1961

STS-61C | 1/6/1986 | Crew: 7

SUMMARY:

System configuration errors resulted in inadvertent drain back of 14,000 lbs of LOX prelaunch, which would have resulted in a Trans-Atlantic Abort Landing.

EVENT DESCRIPTION:

SOURCES:

MER Report | Anomaly PR | LO2 Temerature Probe Incident | Mission Report | Close Call

Apollo 10 | 5/22/1969 | Crew: 2

SUMMARY:

Switch misconfiguration resulted in lunar module control problems.

EVENT DESCRIPTION:

In May 22, 1969 a switch misconfiguration resulted in lunar lander control problems.

During the Lunar Module (LM) last pass, within eight miles of the moon and prior to the jettison of the LM Descent Stage, the Commander (while wearing a space suit) started to troubleshoot an electrical anomaly.

The Abort Guidance System (AGS) was inadvertently switched from HOLD ATTITUDE to AUTO, which caused the LM to look for the Command/Service Module (CSM) and flip end over end.

The attitude indicator was going to the red zone and in danger of tumbling the inertial platform. The Commander was able to grab the hand controller, switch to manual control, jettison the Descent Stage, control the LM Ascent Stage, and finally dock with the CSM.

SOURCES:

Apollo 10

Flight Evaluation Report

Mercury 7 Description & Analysis

Mercury MA-7 | 5/24/1962 | Crew: 1

SUMMARY:

RCS depletion at 80,000 ft.

EVENT DESCRIPTION:

This incident on May 24, 1962 involved the use of double authority control and the accidental actuation of the fly-by-wire high thrust units during certain maneuvers. The manual-system fuel was depleted near the end of the retrofire maneuver, and the automatic-system fuel was depleted at about 80,000 and 70,000 feet. Because of the early depletion of automatic-system fuel, attitude control during re-entry was not available for the required duration. Attitude rates built up after the Automatic Stabilization Control System became inoperative because of the lack of fuel, and these rates were not sufficiently damped by aerodynamic forces. The pilot chose to deploy the drogue parachute manually at an altitude of approximately 25,000 feet to stabilize the spacecraft.

To avoid the same situation on later flights, Mercury MA-8 and subsequent spacecraft contained a switch which allowed the pilot to disable and reactivate the high-thrust units at his discretion. An automatic override reactivated these thrusters just prior to retrofire. Additionally, a revision of fuel management and control training procedures was instituted for subsequent missions

SOURCES:

Progress Collision with Spektr

Mir | 6/25/1997 | Mir Crew: 3 | Loss of Mission | Related or Recurring event

SUMMARY:

Progress M-34 collided with Mir. Spektr pressure shell ruptured. Spektr module isolated. Cables through hatchway impeded hatch closing.

Mir Crew: 3

Loss of Element

EVENT DESCRIPTION:

On June 25, 1997 Progress M-34 collided with the Mir Spektr module rupturing the module. The crew of Mir had to cut through cables in the hatchway in order to seal off the leaking module from the rest of the station.

SOURCES:

Michael Foale

Mir-Progress Collision with Spektr

Mir | 8/30/1994 | Crew: Soyuz 2, Mir 3 | Related or Recurring event

SUMMARY:

Soyuz TM-17 collided twice with Mir during undocking.

Collision

EVENT DESCRIPTION:

On January 14, 1994 during the post-separation inspection fly-around of Mir, the crew lost manual translation control due to a configuration error. The loss of control led to the Soyuz colliding with Mir several times. The cause of the collision was traced to the hand controller in the orbital module which governed braking and acceleration being switched on, disabling the equivalent hand controller in the descent module.

SOURCES:

NTSB Aerospace Accident Report

SpaceShipTwo PF04 | 10/31/2014 | Crew: 2 | Loss of Crew (1)

SUMMARY:

Vehicle breakup during powered flight.

EVENT DESCRIPTION:

On October 31, 2014 shortly after separating from the WhiteKnightTwo carrier aircraft, the SpaceShipTwo vehicle broke apart resulting in the loss of one crew member. A National Transportation Safety Board investigation into the accident is ongoing.

SOURCES:

FAA Press Release - Statment on SpaceShipTwo Incident

Mercury MA-9 | 5/16/1963 | Crew: 1 | Manual Entry

SUMMARY:

Electrical faults caused loss of some systems and need to perform manual entry. Also experienced high PPCO2 levels in suit during entry operations.

EVENT DESCRIPTION:

During the May 16, 1963 flight electrical faults caused the loss of some systems and the need to perform manual entry. The alternating current power supply for the control system failed to operate, and it was determined that the pilot would have to make a manual retrofire and re-entry. He performed these maneuvers with close precision and landed a short distance from the prime recovery ship in the Pacific Ocean.

The malfunction during re-entry on MA-9 was traced to two connectors in an electrical amplifier.

SOURCES:

X-15 3-65-97 | 11/15/1967 | Crew: 1 | Loss of Crew

SUMMARY:

Electrical short and crew error led to loss of control at 230,000 feet. First U.S. spaceflight fatality.

EVENT DESCRIPTION:

This was the first United States spaceflight fatality.

SOURCES:

Hypersonic Before the Shuttle

X-15 Inflight Breakup

Micheal J. Adams

SpaceShipOne 16P | 9/29/2004 | Crew: 1

SUMMARY:

Uncommanded vehicle roll. Control regained prior to apogee.

EVENT DESCRIPTION:

On September 29, 2004 SpaceShipOne performed a series of 60 rolls during last stage of engine burn. SpaceShipOne coasted to 103 km of altitude and successfully completed the first of two X-Prize flights. The motor was shut down when the pilot noted that his altitude predictor exceeded the required 100 km mark. During the motor burn the spacecraft began to roll uncontrollably, but the pilot continued despite advice from the ground to shut the motor down and abort the attempt.

The thin air at that altitude meant that the control surfaces didn't have enough air flowing over them, so they lost effectiveness to compensate for the roll as the spacecraft pointed nearly straight up. The pilot needed to correct the rolling that occurred because of asymmetric thrust coming from the engine.

To correct the issue for the 17P flight, the amount of allowable “down pitch trim” was limited, to avoid the negative-lift condition. The solution was to more gently turn the corner, such that a forward correction later would not be needed. Pointing straight up at burnout was determined to be acceptable, as long as negative lift was not created. This problem was corrected on SpaceShipTwo.

SOURCES:

SpaceShipOne Flight 16P

SpaceShipOne 14P | 5/13/2004 | Crew: 1

SUMMARY:

Flight computer unresponsive. Recovered by rebooting.

EVENT DESCRIPTION:

On May 13, 2004 the flight computer on SpaceShipOne became unresponsive. During the boost following the vertical part of the trajectory, the avionics display flickered and went blank. The ground displays did not show an error. The avionics display on SpaceShipOne came back on as soon as the motor shut down.

Due to the loss of avionics during the boost, the trajectory was not precise. The avionics malfunction was traced to a dimmer, a small electrical component.

SOURCES:

Chapter 10 - Dead Cosmonauts

Altitude Chamber O2 Fire | 3/23/1961 | Crew: 1 | Loss of Crew

SUMMARY:

Alcohol wipe hit hot plate and started fire in oxygen-rich test chamber.

EVENT DESCRIPTION:

On March 23, 1961 a cosmonaut in an altitude chamber was removing the sensors that had been attached to him during an experiment. He cleaned the places where the sensors had been attached with cotton wool soaked in alcohol, and without looking threw away the cotton wool. The cotton wool landed on the ring of an electric hot plate in the oxygen-charged atmosphere of the chamber. In conditions of high oxygen concentration, normally non-flammable substances can burn vigorously. The cosmonaut's training suit caught fire. Unaccustomed to the vigor of high-oxygen fires, the cosmonaut would only have spread the flames further by attempting to smother them. The doctor on duty noticed the conflagration through a porthole and rushed to the hatch, which he could not open because the internal pressure kept the inward swinging hatch sealed. Releasing the pressure through bleed valves took several minutes and the cosmonaut later died in the hospital from the burns.

SOURCES:

Mercury MR-4 | 7/21/1969 | Crew: 1 | Loss of Capsule

SUMMARY:

Inadvertent hatch pyrotechnic firing. Capsule sunk. Astronaut nearly drowned.

EVENT DESCRIPTION:

After landing on July 21, 1961 the spacecraft hatch pyrotechnic charges prematurely fired. The crew member was able to escape from the emergency situation, but because of waves flooding the capsule, the capsule sunk. The crew member was nearly drowned when the flight suit took on water from an unsealed neckdam. The crew member was rescued after three to four minutes in the water.

SOURCES:

Results of the Second Manned Suborbital

STS-3 | 3/30/1982 | Crew: 2

SUMMARY:

Pilot induced oscillation during derotation. Stronger than predicted winds contributed.

EVENT DESCRIPTION:

On March 30, 1982 during orbiter derotation on rollout, the vehicle pitched up to approximately six degrees after having been down to -3 degrees pitch. This pitch up occurred because the pilot was preventing premature nose wheel contact. The planned late transition from autoland to manual control did not provide sufficient time for the pilot to feel the vehicle response, and attempts by the pilot to make minor trajectory adjustments resulted in a touchdown sooner than intended and at a higher than planned airspeed (225 Keas vs. 195 Keas). Subsequently, the derotation after main landing gear touchdown started at too high an airspeed and required the pilot to try and stop it at too low a pitch angle. The rapidly changing elevator trim requirements made it difficult to avoid over-controlling in this situation.

On all future missions, manual takeover from autoland was not planned to occur between the start of the preflare maneuver and touchdown. Flight procedures and crew training were also revised to be more explicit about keeping the nose up until the vehicle slows to 180 knots.

SOURCES:

STS-9 | 12/8/1983 | Crew: 6

SUMMARY:

A. Two APUs caught fire during rollout.

B. GPC failed on touchdown.

C. Incorrect flight control rechannelization on rollout.

EVENT DESCRIPTION:

SOURCES:

STS-37 | 4/11/1991 | Crew: 5

SUMMARY:

Several factors contributed to a low-energy landing 623 feet prior to the threshold of the runway at the backup landing location.

Low Energy Landing

EVENT DESCRIPTION:

On April 11, 1991 the first landing opportunity at Kennedy Space Center was waived due to fog, and a decision was made to land at the alternate landing site at Edwards Air Force Base. The entry wind profile included a large wind shear (from 90 kts at 13,000 feet to 10 kts at 8,000 feet). These conditions fell outside the Edwards Air Force Base 99 percent wind profile from 20,000 feet to 10,000 feet and significantly outside the shuttle experience base from 30,000 feet to 10,000 feet.

Around the Heading Alignment Circle (HAC), a significant amount of energy was lost due to a consistent negative pitch attitude error, and being outside of the HAC reference. The HAC is designed to provide an “energy pad” for use while making the approach. If guidance senses that the vehicle's energy state is getting very low (it uses altitude below a reference altitude and degrees of turn remaining to make the judgment), the HAC radius is decreased to help make up for the lower energy state. At approximately 23,000 feet the low-energy state triggered HAC shrink (when the range-to-go “distance from the vehicle to the runway” falls below the max lift/drag line). The HAC shrink was triggered due to the altitude being approximately 2-3,000 feet low, and increased the error from the HAC reference. A slow convergence back to the altitude reference was seen though the energy state remained low. At 13,500 feet the vehicle encountered a sharp wind shear reducing the vehicle's airspeed driving the energy state even lower. The vehicle again encountered wind shear at 8,600 feet in altitude. Touchdown occurred 623 feet prior to the threshold at 168 kts.

It is believed that the loss of energy on the HAC combined with the inadequate correction back to the altitude profile, both coming off the HAC and through the wind shear, resulted in the low-energy touchdown.

SOURCES:

STS-37 Weather Group Report

Post-Flight Report

STS-90 | 5/3/1998 | Crew: 7

SUMMARY:

Hard, fast landing due to human factors and rogue wind gust. Hardest shuttle landing.

EVENT DESCRIPTION:

Following the landing on May 3, 1998 the post-mission report indicated a harder than normal landing. The main gear touchdown speed was 196.2 Keas with a sink rate of -3.18 feet/second. Brake energies were all below 15 million ft-lbs. The rollout distance was 9769.3 feet. Imagery analysis indicated a main landing gear sink rate of -6.7 ft/sec and a "harder than normal" landing. The Mission Operations Directorate Space Shuttle Summary reported touchdown of the main landing gear at 218 Keas, a -6.0 ft/sec sink rate, and a rollout distance of 9998 feet.

SOURCES:

STS-108 | 12/7/2001 | Crew: 7

SUMMARY:

Violation of minimum landing weather requirements.

EVENT DESCRIPTION:

On December 17, 2001 the Shuttle Meteorology Group forecasted a “no go” for the de-orbit burn due to a weather forecast predicting the creation of a cloud ceiling at landing time. The Shuttle Training Aircraft reported a “go” based on observed conditions. Several positive factors provided the Flight Director with confidence to give a GO for landing on orbit 186, despite a weather forecast which could result in the crew being unable to see the Precision Approach Path Indicators (PAPIs) or runway environment until 3,000 feet or below. The GO was given with the belief that the cloud layer at 3,000 feet would break and that the PAPIs and runway environment would be visible by 6,500 feet. However, the cloud ceiling did not break and a flight rule was violated, but waived following the flight.

SOURCES:

Meteorology Report

Entry FDO Post Flight

STS-137 | 6/1/2011 | Crew: 7

SUMMARY:

Brief fire observed between the left main landing gear tires during runway rollout.

EVENT DESCRIPTION:

SOURCES:

Voskhod 2 | 3/19/1965 | Crew: 2

SUMMARY:

Automatic descent system malfunctioned. Issues with manual entry resulted in off-target, rough terrain landing. Delayed crew recovery.

EVENT DESCRIPTION:

On March 19, 1965 a malfunction of the automatic descent system resulted in the use of a backup manual system for entry and landing. Difficulties encountered during manual operation and delayed retrofiring resulted in the spacecraft landing more than 1,000 km downrange from the intended landing point. The wooded, mountainous terrain caused a delay in crew recovery. (Actual distance of overshoot varies in the source documents, but most sources indicate a distance between 1,000 km and 2,500 km.)

SOURCES:

The Nighmare of Voskhod 2

Gemini 5 | 8/29/1965 | Crew: 2

SUMMARY:

Erroneous entry data uplinked; crew manually corrected entry flight profile.

EVENT DESCRIPTION:

SOURCES:

The Covered Wagon

Skylab 4 Technical Debrief (see page 9-26)

Skylab 4 | 2/8/1974 | Crew: 3

SUMMARY:

Incorrect circuit breakers opened, resulting in the loss of the automatic control.

EVENT DESCRIPTION:

On February 8, 1974 while preparing foar entry, the crew inadvertently opened the stabilization and control system (SCS) pitch and yaw circuit breakers instead of the service propulsion system pitch and yaw circuit breakers. The vehicle was in an apex forward configuration for service module jettison. The commander attempted to orient the vehicle to the proper heat shield forward attitude for entry. The control commands produced no effect due to the SCS being inadvertently unpowered, and the vehicle failed to change attitude. The crew switched to “manual reaction control system direct” and oriented the vehicle to the proper attitude. The circuit breakers being in close proximity and similarly labeled, increased the potential for human error.

The failure to orient the heat shield forward would have caused loss of crew.

SOURCES:

Soyuz TM-5 | 9/6/1988 | Crew: 2

SUMMARY:

Two de-orbit attempts failed. Crew confined to DM due to OM being jettisoned prior to 1st de-orbit attempt. Crew prevented erroneous firing of SM separation pyrotechnics.

EVENT DESCRIPTION:

SOURCES:

Apollo Soyuz Mission Anomaly Report

Apollo ASTP | 7/24/1975 | Crew: 3 | Crew Injury

SUMMARY:

N2O4 in crew cabin. Crew hospitalized for 2 weeks.

EVENT DESCRIPTION:

On July 24, 1975 as the spacecraft descended, the commander, who was reading the checklist, failed to tell the command module pilot to move the Earth Landing System auto/manual switch to auto. The crew saw that the spacecraft was well below the deployment altitude and proceeded to manually deploy the chutes. Drogue chutes were deployed manually at 18,550 feet instead of 23,500 feet as the automatic system would have done. At 10,000 feet the commander realized that ELS was not in AUTO and quickly switched ELS Logic and AUTO, deploying the main parachutes at 7,150 feet and disabling the RCS instead of 10,500 feet.. The Reaction Control System (RCS) was not disabled manually (RCS command switch turned to “off”) at this time. It was disabled manually at 16,000 feet instead of when the checklist indicated at 24,000 feet. The cabin pressure relief valve opened automatically at 24,500 feet.

During a 30-second period of high thruster activity after drogue parachute deployment, a mixture of air and propellant combustion products followed by a mixture of air and nitrogen tetroxide oxidizer (N2O4) vapors were sucked into the cabin. One of the positive roll thrusters is located only two feet away from the steam vent that pulls in outside air when the cabin relief valve is open. This exposed the crew to a high level of N2O4 since emergency oxygen masks were not available until landing. The pilot passed out, but the commander quickly put the oxygen mask on him and he was revived. The exposure resulted in a two-week hospital stay for the crew after landing.

SOURCES:

Asynchronicity

July 24th - Last Splash

Soyuz 10 | 4/23/1971 | Crew: 3 | Loss of Mission | Related or Recurring event

SUMMARY:

Automatic docking system failed. Manual docking with Salyut not achieved.

EVENT DESCRIPTION:

On April 23, 1971 during automatic approach to Salyut, the Soyuz began to oscillate. The crew went to manual control and was able to complete mechanical capture. During retraction of the probe, the engines began firing because the Soyuz control system was still active. This caused damage to the docking mechanism, which stopped the probe retraction and prevented the Soyuz from completing docking to the Salyut. The crew was instructed to reconfigure cables which allowed them to send a command to release the probe's capture latches. Soyuz was released, and landing occurred on April 25.

SOURCES:

Soyuz 10

Skylab 2 | 5/26/1973 | Crew: 3 | Related or Recurring event

SUMMARY:

Multiple failed automatic docking attempts resulted in manual docking to Skylab.

EVENT DESCRIPTION:

On May 26, 1973 numerous failed docking attempts resulted in the use of contingency in-flight procedures to bypass the automated docking system. Successful docking to the Skylab station ultimately relied on manual control and crew piloting skills.

The contingency procedure required the Skylab 2 crew members to don pressure suits, depressurize the command module cabin, open the tunnel hatch, cut wires in the probe, and connect the emergency probe-retract cable using a utility power outlet. The crew members were able to fire the probe-retract pyrotechnic and complete docking manually.

The failure to dock would have resulted in the loss of Skylab due to the inability to perform critical repairs.

SOURCES:

Skylab 2

Skylab 1-2 Technical Debrief

Living and Working in Space: A History of Skylab

Mir | 8/30/1994 | Mir Crew: 2 | Related or Recurring event

SUMMARY:

Progress M-24 collided with Mir during second docking attempt.

Collision

EVENT DESCRIPTION:

On August 30, 1994 during the second attempt of the Progress M-24 to dock with Mir, the Progress collided with Mir's forward docking unit two to four times, and then drifted away from the station. The docking problems with Progress M-24 have been variously attributed to software or Kurs electronics failures on Progress M-24, or the failure of control equipment in the Moscow Mission Control Center.

SOURCES:

M21-D21 | 7/30/1966 | Crew: 2 | Loss of Crew

SUMMARY:

D21 drone collided with M21 during launch, causing M21 breakup. Crew survived breakup but one was lost after water landing.

EVENT DESCRIPTION:

On July 30, 1966 as the M-21 mothership was performing a flight test for launching the D-21 drone, while traveling at high Mach speeds the drone was not able to penetrate the shock wave coming off the mothership. The D-21 had almost cleared the rudders of the M-21 when the drone bounced off the shockwave and pitched down, striking the M-21 and breaking it in half. The Pilot and Launch Control Officer (LCO) stayed with the tumbling wreckage of the plane a short time until a lower altitude was reached, then ejected over the Pacific Ocean.

Both crew members made safe ejections and landings, but after landing the LCO opened his helmet visor by mistake and his suit filled with water, causing him to drown. All subsequent flights of the D-21 were as D-21Bs, which were reconfigured to launch the drone from an under wing pylon of a B-52 (much like the X-15 had been), boosted to Mach 3 by a rocket motor that was jettisoned after the D-21Bs Marquardt ramjet was started.

SOURCES:

Loss of M-21 and D-21

Gemini 8 | 3/16-3/17/1966 | Crew: 2 | Emergency De-orbit | Loss of Mission

SUMMARY:

Stuck thruster caused loss of control and led to 1st U.S. emergency
de-orbit.

EVENT DESCRIPTION:

SOURCES:

Soyuz 33 | 4/12/1979 | Crew: 2 | Loss of Mission

SUMMARY:

Main engine anomaly caused final rendezvous abort.

EVENT DESCRIPTION:

SOURCES:

Soyuz 33

STS-32 | 1/9/1990 | Crew: 5 | Loss of Attitude Control

SUMMARY:

Erroneous state vector up-linked to flight control system, causing immediate and unpredictable attitude control problems.

EVENT DESCRIPTION:

An erroneous state vector up-linked to the flight control system on January 9, 1990 causing immediate and unpredictable attitude control problems.

At 17:23:46:51 Greenwich Mean Time, during a crew sleep period, a state vector update was commanded by the ground prior to the loss of signal. The uploaded state vector was erroneous, and the orbiter began to execute a multi-axis rotation at three degrees per second with a number of thruster firings. The rotation continued until the acquisition of signal period, about 10 minutes later, when the crew was awakened and instructed to switch to manual Digital Auto Pilot to arrest the unwanted rates. A good state vector was then uplinked.

SOURCES:

Crew Accidentally Pulls Plug on Mir

Mir | 7/17/1997 | Crew: 3

SUMMARY:

Accidental unplugging of computer power cable led to loss of attitude control and loss of power.

EVENT DESCRIPTION:

On July 16, 1997 a cosmonaut inadvertently unplugged a central computer power cable while disconnecting cables for upcoming repairs of the Spektr module. The temporary loss of power caused the central computer to shut down, resulting in the loss of attitude control and Mir going into free drift. In free drift the Mir was unable to accurately point its solar arrays to provide sufficient power. Once in free drift, the ground and flight crew failed to turn off equipment to reduce power demand, which resulted in depletion of stored energy in the flight batteries and complete loss of power on Mir.

The Progress M-35 supply spacecraft was used to reorient the Mir to restore nominal solar array power generation, recharge flight batteries, and subsequently restore Mir attitude control functions.

SOURCES:

Mir Loses all power after accident

STS-87 | 11/27/1997 | Crew: 6

SUMMARY:

Spartan satellite deployed without proper activation.

Recapture with RMS unsuccessful. Later captured by EVA crew.

EVENT DESCRIPTION:

Deployment of the SPARTAN satellite on November 21, 1997 occurred without proper activation.

A crew input via the Payload and General Support Computer was not received by the spacecraft. Lack of telemetry and onboard verification procedures left this condition undetected by the Mission Control Center and flight crew. The SPARTAN was grappled with the Remote Manipulator System, removed from the Release/Engage Mechanism, and released per the flight plan.

The missed command step resulted in the failure of the SPARTAN to execute an expected preprogrammed maneuver ("pirouette") about 2.5 minutes after deploy. Attempts to re-grapple the SPARTAN after the deployment were unsuccessful. A previously scheduled extravehicular activity (space walk) had to be changed to manually recapture the satellite.

SOURCES:

Station Crew Removes Ammonia Pump

Investigation Report

ISS Increment 38 | 12/1/2013 | Crew: 6

SUMMARY:

ITCS configuration errors resulted in near freezing and potential rupture of water-to-ammonia heat exchanger.

EVENT DESCRIPTION:

SOURCES:

Anomaly Log

ITCS Heat Exchanger Close Call Case Study

Close Call Outbrief

LAUNCH/GROUND

SUBORBITAL FLIGHTS

RESEARCH FACILITY

ATMOSPHERIC FLIGHTS

LANDING & POSTLANDING

View Training & Human Factors Entries

Hide Training & Human Factors Entries

Events in which emergency systems or contingency procedures/capabilities were used to mitigate the risk to crew safety (e.g., activation of launch abort system, fire suppression systems), or the lack of the systems/capabilities or contingency planning compromised crew safety. Includes medical emergency events resulting in early return of crew and events where crew systems failed to protect crews (crew restraints).

Loss of Crew

Crew Injury/Illness and/or Loss of Vehicle or Mission

Related or Recurring event

TPS Entry Events

(1981-2003)

Mir Collision Events

1994-1997

Fire/Overheating Events

(1971-2008)

Soyuz Landing Events

(1967-1993)

Service/Descent Module Separation Failures

(1961-2008)

Medical Evacuations (1976-1987)

(1981-96)

SRB Seal Events

On-pad Abort Events (1984-93)

*toxic byproducts released

STS-51L (Challenger)

1/28/1986

Soyuz 18-1(18a)

4/5/1975

Apollo 12

11/14/1969

STS-41D

6/26/1984

Soyuz T-10-1(T-10a)

9/26/1983

Other on-pad abort events:

STS-51F, STS-55, STS-51, STS-68

Apollo 1 (AS-204)

1/27/1967

Gemini 6

12/12/1965

Apollo 13

4/13/1970

ISS, Increment 17

4/30/2008

ISS, Increment 2-4

4/2001-3/2002

Soviet Altitude

Chamber O2 Fire

3/23/1961

Apollo 10

5/22/1969

Mir EO-2, 1987, Crew: 2

Salyut 7, 1985, Crew: 3

Salyut 5, 8/25/1976, Crew: 2

Apollo 11

7/21/1969

Mir

7/17/1997

STS-83

4/6/1997

STS-2

11/12/1981

Mir

6/25/1997

Mir, 10/94, Crew: 6

Soyuz 1

4/23/1967

M21-D21

7/30/1966

Gemini 8

3/16-17/1966

SR-71

1/25/1966

Mercury MA-9

5/16/1963

Soyuz T-11

10/2/1984

Soyuz TMA-11 (15S)

4/19/2008

Soyuz TMA-10 (14S)

10/21/07

Crew: 3

Soyuz 5

1/18/69

Crew: 2

Soyuz 11

6/30/1971

Voskhod 2

3/19/65

Crew: 1

Vostok 5

6/19/63

Crew: 1

Vostok 2

8/7/61

Crew: 1

Gemini 4

6/7/1965

Vostok 1

4/12/61

Crew: 1

Voskhod 2

3/19/1965

Mercury MA-7

5/24/1962

STS-107 (Columbia)

2/1/2003

Soyuz TM-15

2/1/93

Soyuz TM-14

8/10/92

Soyuz TM-12

10/10/91

Soyuz TM-7

4/27/89

Soyuz T-7

12/10/82

Soyuz 36

7/31/80

Soyuz 23

10/16/76

Soyuz 18-1(18a)

4/5/75

Soyuz 5

1/18/69

Mercury MR4

7/21/1961

Soyuz 1

4/24/67

Gemini 6 | 12/12/1965 | Crew: 2

SUMMARY:

EVENT DESCRIPTION:

There was a main engine shutdown during the attempted launch on December 12,1965.

About 1.5 seconds after main engine ignition, an electrical plug fell from the vehicle and accidentally started a clock that normally starts during vehicle liftoff.

A successful launch occurred three days later.

SOURCES:

Go Back to Go

Apollo I (AS-204) | 1/27/1967 | Crew: 3 | Loss of Crew

SUMMARY:

Crew cabin fire (electrical short + high pressure O2 atmosphere).

EVENT DESCRIPTION:

On January 27, 1967 the crew cabin of Apollo 1 caught fire during a test with three crew members inside. The cabin was filled with a pure oxygen atmosphere and pressurized greater than ambient pressure (16.7 psi). Over the course of several hours, the oxygen permeated all materials in the cabin, which had been tested to the normal flight pressure of pure oxygen (5 psi). When the fire began it spread rapidly. Due to the pressure in the cabin, the crew members could not open the hatch to escape. Technicians in the room outside the capsule attempted to open the hatch but were driven back by the heat and smoke. Some technicians donned the available gas masks, but the masks were designed to protect against hypergolic propellant fumes, not smoke. Consequently, these technicians lost consciousness after a short time in the smoke-filled room.

All three crew members were lost.

The fire was caused by an electrical short from an unprotected wire. A subsequent review of all wiring dioded to both Main Bus A and B identified a problem with an environmental control system instrumentation wire powered from Main Bus A and B. The wire was routed over plumbing lines on the crew compartment floor, located below the left-hand crew seat, going into the left-hand equipment bay, between the environmental control unit and the oxygen panel. This Teflon-insulated wire should have had a protective Teflon overwrap, but closeout photos showed that the overwrap had slipped down, no longer providing protection. The commander likely contacted this wire with his foot when he turned to change his communications cable. The most probable initiator of the fire is an electrical arc from this wire, which was unprotected from external damage.

Factors contributing to this accident include:

- Failure to identify the test as hazardous

- Inward-opening hatch which could not be opened during periods of increased cabin pressure

- Inadequate ground safety procedures and emergency equipment

- Last-minute changes to operational test procedures

- Unsatisfactory communications overall

- Lack of control of combustible materials

- Deficiencies in engineering, workmanship, and quality control

SOURCES:

Apollo 12 | 11/14/1969 | Crew: 3

SUMMARY:

Lightning strike on ascent.

EVENT DESCRIPTION:

During the Apollo 12 launch on November 14, 1969 lightning struck the spacecraft.

Light rain was falling, but weather conditions did not indicate any thunderstorm activity. There were seven miles of visibility with cloud break estimated at 800 feet and overcast conditions at 10,000 feet.

At 11:22am, T+36 seconds, the crew saw a bright light.

At T+36.5 seconds many errors occurred: Fuel Cells 1, 2, and 3 disconnected; Main Buses A and B were under-voltage; Alternating Current (AC) Buses 1 and 2 overloaded. The warning lights and alarm came on in the cabin, indicating failure of the Inertial Stabilization System.

At T+52 seconds (13,000 feet) lightning struck the vehicle and the Inertial Measurement Unit platform tumbled.

The potential effect on the vehicle was induction into wiring, depending on the location and rate of change of potential and direct current flow in grounding. The high negative voltage spike (delta voltage/delta time) caused the Silicon Controlled Rectifiers to trip on the Fuel Cell and AC Inverter overload sensors. Failures occurred in four Service Module Reaction Control System helium tank quantity measurements, five thermocouples, and four pressure/temperature transducers.

Using power from the Battery Relay Bus, the crew reconnected the Fuel Cells to Main Bus A and B, and reconnected the inverters to AC Bus 1 and 2. The mission continued.

SOURCES:

Soyuz 18-1(18a) | 4/5/1975 | Crew: 2 | Loss of Vehicle/Mission

SUMMARY:

EVENT DESCRIPTION:

One crew member suffered internal injuries from the high-g re-entry and downhill fall and never flew again.

SOURCES:

STS-51L (Challenger) | 1/28/1986 | Crew: 7 | Loss of Crew | Related or Recurring event

SUMMARY:

SRB seal failure.

EVENT DESCRIPTION:

Seventy-four seconds into flight, the Space Shuttle Challenger broke up.

All seven crew members were lost.

SOURCES:

Other On Pad Aborts | Related or Recurring events

On pad aborts have also occurred on:

SOURCES:

STS-51F Mission Report

STS-51 Mission Report

STS-55 Mission Report

STS-68 Mission Report

Apollo 13 | 4/13/1970 | Crew: 3 | Loss of Mission

SUMMARY:

Explosion due to electrical short. Loss of O2 and EPS.

EVENT DESCRIPTION:

SOURCES:

Apollo 11 | 7/21/1969 | Crew: 2

SUMMARY:

Engine arm circuit breaker knob broke off. Circuit breaker successfully reset allowing ascent.

EVENT DESCRIPTION:

SOURCES:

Apollo 10 | 5/22/1969 | Crew: 2

SUMMARY:

Switch misconfiguration resulted in lunar module control problems.

EVENT DESCRIPTION:

In May 22, 1969 a switch misconfiguration resulted in lunar lander control problems.

The Abort Guidance System (AGS) was inadvertently switched from HOLD ATTITUDE to AUTO, which caused the LM to look for the Command/Service Module (CSM) and flip end over end.

SOURCES:

Apollo 10

Flight Evaluation Report

Salyut 5 | 8/25/1976 | Crew: 2 | Crew Illness

SUMMARY:

Early return of crew due to health effects from suspected toxic gases in space station.

EVENT DESCRIPTION:

The Salyut 5 initial crew departed the station early, using Soyuz 21, on August 25, 1976. This was attributed to various causes including fire, environmental system failure, and crew health problems caused by fumes from chemicals used to develop film from the station's surveillance cameras. The subsequent mission crew (Soyuz 24) entered the station wearing protective breathing masks due to the potential contamination.

SOURCES:

Investigative findings backed by nominal Soyuz TMA-13 return

Soyuz TMA-11 (15S) | 4/19/2008 | Crew: 3 | Crew Injury (1) | Related or Recurring event

SUMMARY:

Ballistic, high g entry and landing over 400 km short of intended target.

EVENT DESCRIPTION:

SOURCES:

Investigative findings backed by nominal Soyuz TMA-13 return

Soyuz TMA-10 (14S) | 10/21/2007 | Crew: 3 | Related or Recurring event

EVENT DESCRIPTION:

SOURCES:

Soyuz 5 | 1/18/1969 | Crew: 2 | Related or Recurring event

EVENT DESCRIPTION:

SOURCES:

Soyuz 5's Flaming Return

Voskhod 2 | 3/19/1965 | Crew: 1 | Related or Recurring event

EVENT DESCRIPTION:

SOURCES:

The Nightmare of Voskhod 2

Vostok 5 | 6/19/1963 | Crew: 1 | Related or Recurring event

EVENT DESCRIPTION:

SOURCES:

Vostok 5

Vostok 2 | 8/7/1961 | Crew: 1 | Related or Recurring event

EVENT DESCRIPTION:

SOURCES:

Vostok 2

Vostok 1 | 4/12/1961 | Crew: 1 | Related or Recurring event

EVENT DESCRIPTION:

SOURCES:

The Flight of Vostok 1

Soyuz T-10-1 (T-10a) | 9/26/1983 | Crew: 2 | Loss of Vehicle/Mission | Related or Recurring event

SUMMARY:

Pad booster fire/explosion. Capsule Escape System used.

Crew: 2

EVENT DESCRIPTION:

Shortly before liftoff on September 26, 1983 fuel spilled around the base of the Soyuz launch vehicle and ignited the vehicle. Launch control activated the escape system, but the control cables were burnt.

Twenty seconds later ground control activated the escape system by radio command. By this time the booster was engulfed in flames.

Explosive bolts fired to separate the descent module from the service module. Explosive bolts also fired to separate of the upper shroud from the lower shroud. The escape system motor pulled the orbit module and descent module, still encased within the upper shroud, away from the booster at 14 to 17g of acceleration.

Seconds after the escape system activated, the booster exploded, destroying the launch complex.

The descent module separated from the orbital module and dropped free from the shroud. The descent module heat shield was discarded to expose the solid-fueled landing rockets. A fast-opening emergency parachute was deployed and landing occurred about four km from the launch pad.

SOURCES:

MIR Hardware Heritage

NASA Astonauts on Soyuz

Related or Recurring event

In addition to three overheating/fire events on the ISS and two significant events on Mir in 1997 and 1998, other overheating/fire events also occurred on:

Mir (October 1994) (A)

STS-40 (June 1991) (B)

STS-35 (December 1990) (C)

STS-28 (August 1989) (D)

STS-6 (April 1983) (E)

Salyut 7 (September 1982) (F)

Salyut 6 (1979) (G)

Salyut 1 (June 1971) (H)

SOURCES:

Progress Collision with Spektr

Mir | 6/25/1997 | Mir Crew: 3 | Loss of Mission | Related or Recurring event

SUMMARY:

Progress M-34 collided with Mir. Spektr pressure shell ruptured. Spektr module isolated. Cables through hatchway impeded hatch closing.

Mir Crew: 3

Loss of Element

EVENT DESCRIPTION:

SOURCES:

Michael Foale

Mir-Progress Collision with Spektr

SR-71 | 7/30/1966 | Crew: 2 | Loss of Crew (1)

SUMMARY:

Loss of control at high speed and altitude.

EVENT DESCRIPTION:

On January 25, 1966 the SR-71 aircraft disintegrated during a high-speed, high-altitude test flight when the breakdown of super sonic airflow resulted in engine cutoff (also known as engine un-start). This occurred during a turn at speeds exceeding Mach 3.17 and a bank of 35 degrees. The bank immediately increased to 60 degrees. The nose pitched up and the aircraft broke apart. The pilot was thrown clear (his ejection seat never left the plane). He blacked out during the accident, but recovered and landed on the ground safely. His Reconnaissance System Officer did not survive the high-g bailout.

SOURCES:

Blackbird Losses

Mercury MA-9 | 5/16/1963 | Crew: 1 | Manual Entry

SUMMARY:

Electrical faults caused loss of some systems and need to perform manual entry. Also experienced high PPCO2 levels in suit during entry operations.

EVENT DESCRIPTION:

The malfunction during re-entry on MA-9 was traced to two connectors in an electrical amplifier.

SOURCES:

Altitude Chamber O2 Fire | 3/23/1961 | Crew: 1 | Loss of Crew

SUMMARY:

Alcohol wipe hit hot plate and started fire in oxygen-rich test chamber.

EVENT DESCRIPTION:

SOURCES:

Chapter 10 - Dead Cosmonauts

Soyuz 1 | 4/24/1967 | Crew: 1 | Loss of Crew | Related or Recurring event

SUMMARY:

Main and reserve parachutes failed.

Crew: 1

EVENT DESCRIPTION:

On April 24, 1967 on the maiden flight of the Russian Soyuz spacecraft, the cosmonaut encountered an anomaly with the parachute system during descent. During the descent the drag chutes successfully deployed, but the main chutes failed to deploy from their container. Detecting increasing speeds, the computer deployed a backup parachute. Because the drag chute was still attached and failed to release, the backup chute became tangled with the drag chute, preventing the deployment of the backup chute and resulting in a high-speed impact with the ground.

One cosmonaut was lost.

SOURCES:

Soyuz 5 | 1/18/1969 | Crew: 1 | Crew Injury | Related or Recurring event

SUMMARY:

Landing rockets failed to fire, resulting in a hard landing.

EVENT DESCRIPTION:

On January 18, 1969 the Soyuz 5 soft landing rockets failed to fire, resulting in a harder than normal landing. Because of the force of the impact, one crew member onboard broke his teeth.

SOURCES:

Soyuz 18-1 (18a) | 4/5/1975 | Crew: 2 | Crew Injury | Related or Recurring event

SUMMARY:

After ascent abort, capsule landed on snowy slope above cliff. Parachute snagged and prevented fall.

EVENT DESCRIPTION:

One crew member suffered internal injuries from the high-g re-entry and downhill fall and never flew again.

SOURCES:

Soyuz 23 | 10/16/1976 | Crew: 2 | Related or Recurring event

SUMMARY:

Landed on frozen lake during blizzard. Delayed recovery.

EVENT DESCRIPTION:

On October 16, 1976 the Soyuz 23 descent module landed in Lake Tengiz, 2 km from shore. The water caused an electrical short which caused the reserve parachute to deploy. Parachute lines from the main and reserve parachute kept the capsule lying on its side in the water, preventing the hatch from opening and blocking the air vent. Transmission antennas became inoperable due to submersion in the water, and the inner walls of the capsule became covered with ice. The recovery team concluded the crew was dead and dragged the capsule to the shore to await the special team to remove the bodies. After eleven hours in the capsule the crew inside finally opened the hatch from the inside.

SOURCES:

Soyuz 36 | 7/31/1980 | Crew: 2 | Related or Recurring event

SUMMARY:

Landing rockets failed to fire resulting in ~30 g impact.

EVENT DESCRIPTION:

On July 31, 1980 the Soyuz 36 soft landing rockets failed to fire before touchdown, resulting in an impact at more than 30 g.

SOURCES:

Soyuz T-7 | 12/10/1982 | Crew: 2 | Related or Recurring event

SUMMARY:

Landed on hillside and rolled downhill. One cosmonaut thrown from seat.

EVENT DESCRIPTION:

On December 10, 1982 Soyuz T-7 landed on a hillside and rolled down the hill. One of the cosmonauts was thrown from his seat as a result of the rolling.

SOURCES:

Soyuz TM-7 | 4/27/1989 | Crew: 2 | Crew Injury | Related or Recurring event

SUMMARY:

Double-impact “hard landing.”

EVENT DESCRIPTION:

On April 27, 1989 a double-impact, “hard landing” resulted in an injury to a crew member's leg. The injury required medical treatment at the landing site. The hard landing has been attributed to gusty winds at the landing site.

SOURCES:

Soyuz TM-12 | 10/10/1993 | Crew: 3 | Related or Recurring event

SUMMARY:

Hard impact. News team reported capsule as “very dented.”

EVENT DESCRIPTION:

On October 10, 1991 Soyuz TM-12 experienced a hard landing impact, and a television crew reported that the capsule was 'very dented' and lying on its side.

SOURCES:

Soyuz TM-14 | 8/10/1992 | Crew: 3 | Related or Recurring event

SUMMARY:

Hard landing impact. Hatch jammed, requiring cosmonauts to use tools to pry open.

EVENT DESCRIPTION:

On August 10, 1992 a hard landing impact led to the descent module turning over on its side and leaving the crew sideways. The spacecraft hatch also jammed and could not be opened from the outside, requiring the cosmonauts to use tools to pry it open. High winds in the landing area may have contributed to the severity of the impact.

SOURCES:

Soyuz TM-15 | 2/1/1993 | Crew: 2 | Related or Recurring event

SUMMARY:

Rolled down hillside.

EVENT DESCRIPTION:

Upon landing on February 1, 1993 Soyuz TM-15 rolled down hill and stopped on its side 150 meters from the shore of a salt marsh.

SOURCES:

Mercury MR-4 | 7/21/1969 | Crew: 1 | Loss of Capsule

SUMMARY:

Inadvertent hatch pyrotechnic firing. Capsule sunk. Astronaut nearly drowned.

EVENT DESCRIPTION:

SOURCES:

Results of the Second Manned Suborbital

STS-107 (Columbia) | 2/1/2003 | Crew: 1 | Loss of Crew | Related or Recurring event

SUMMARY:

TPS damage from ascent debris strike resulted in loss of crew and vehicle on entry. Similar bipod ramp foam loss occurred on STS-7, STS-32, STS-50, STS-52, STS-62, and STS-112.

EVENT DESCRIPTION:

Damage to the Thermal Protection System from a debris strike on ascent resulted in the loss of crew and vehicle on entry on February 1, 2003.

Seven crew members were lost.

SOURCES:

Mercury 7 Description and Analysis

Mercury MA-7 | 5/24/1962 | Crew: 1

SUMMARY:

Pitch horizon scanner failed, resulting in manual entry and off-target landing. Delayed crew recovery.

EVENT DESCRIPTION:

On May 24, 1962 the failure of the spacecraft pitch horizon scanner required the pilot to assume manual control of the spacecraft for retrofire. As a result, the spacecraft attitude was outside of the recommended range for automatic initiation of the retrofire signal. Manual initiation of the retrofire signal occurred several seconds later than scheduled.

The delay in retrofire initiation and the less-than-ideal spacecraft attitude contributed to the spacecraft landing 250 nautical miles downrange of the intended landing point which delayed crew recovery.

SOURCES:

Voskhod 2 | 3/19/1965 | Crew: 2

SUMMARY:

Automatic descent system malfunctioned. Issues with manual entry resulted in off-target, rough terrain landing. Delayed crew recovery.

EVENT DESCRIPTION:

SOURCES:

The Nighmare of Voskhod 2

Gemini 4 | 6/7/1965 | Crew: 2

SUMMARY:

Erroneous entry data uplinked; crew manually corrected entry flight profile.

EVENT DESCRIPTION:

On June 7, 1965 the computer could not be updated for entry, could not be turned off, and then stopped working entirely. The crew resorted to a rolling Mercury-type entry, rather than the lifting bank angle the computer was supposed to help them achieve.

SOURCES:

Four Days and a "Walk"

Gemini 4 Computer Report

Soyuz 11 | 6/30/1971 | Crew: 3 | Loss of Crew

SUMMARY:

Pyrotechnic system failure resulted in crew module rapid depress.

EVENT DESCRIPTION:

All three crew members were lost.

SOURCES:

Descent into the Void

Soyuz T-11 | 10/2/1984 | Crew: 3

SUMMARY:

Partial failure of atmospheric entry control system.

EVENT DESCRIPTION:

Partial failure of the atmospheric entry control system of Soyuz T-11 led to a moderately high (5-6 g) deceleration force.

SOURCES:

Salyut 7 | 1985 | Crew: 3 | Crew Illness

SUMMARY:

One returned with visiting crew due to medical condition.

EVENT DESCRIPTION:

Because a crew member became ill, the crew of Salyut 7 modified crew operations and ultimately departed the station on November 13, 1985, prior to full mission completion which would have occurred on November 21, 1985.

SOURCES:

Mir EO-2 | 7/24/1987 | Crew: 2 | Crew Illness

SUMMARY:

One crew member replaced early due to medical condition.

EVENT DESCRIPTION:

On July 24, 1987 during the Mir Principle Expedition 2 (EO-2) one crew member was diagnosed with a heart problem by ground-based doctors and returned to Earth early.

SOURCES:

M21-D21 | 7/30/1966 | Crew: 2 | Loss of Crew

SUMMARY:

D21 drone collided with M21 during launch, causing M21 breakup. Crew survived breakup but one was lost after water landing.

EVENT DESCRIPTION:

SOURCES:

Loss of M-21 and D-21

Gemini 8 | 3/16-3/17/1966 | Crew: 2 | Emergency De-orbit | Loss of Mission

SUMMARY:

Stuck thruster caused loss of control and led to 1st U.S. emergency
de-orbit.

EVENT DESCRIPTION:

SOURCES:

Soyuz 1 | 4/23/1967 | Crew: 1 | Loss of Mission

SUMMARY:

Failures in attitude control and electrical power systems resulted in a loss of mission. The launch of the intended docking target, Soyuz 2, was scrubbed.

EVENT DESCRIPTION:

SOURCES:

STS-2 | 11/21/1981 | Crew: 2 | Minimum Duration Flight | Crew Injury

SUMMARY:

Failure of fuel cell resulted in a MDF being declared. The fuel cell failure also resulted in hydrogen in the drinking water leading to crew dehydration.

EVENT DESCRIPTION:

During the flight of STS-2, which spanned from November 12 – 14, 1981, fuel cell failure led to the declaration of a minimum duration flight (MDF). In addition to the MDF, the failure of the fuel cell also led to high hydrogen levels in the drinking water. The fuel cells used produce drinking water as a by product. When the crew drank this water it provoked a need to belch. Belching in zero g leads to regurgitation. The crew avoiding drinking the water in order to avoid belching, which caused crew dehydration. Prior to entry, crew members fluid load to offset fluid shift when returning from orbit. The crew dehydration increased the effects of the fluid shift and could have posed a risk during high g entry procedures due to a higher chance for loss of consciousness.

SOURCES:

Oral History Report

STS-83 | 4/6/1997 | Crew: 7 | Loss of Mission

SUMMARY:

Failure of fuel cell number 2 resulted in MDF being declared. The 15-day mission was shortened to 3 days.

EVENT DESCRIPTION:

A failure of fuel cell (FC) number two resulted in a minimum duration flight being declared on April 6,1997. The 16-day mission was reduced to four days due to FC problems encountered on flight day two. During prelaunch operations the differential voltage on FC 2, substack 3 remained above the 150mV limit (defined in the Operations and Maintenance Requirements Specification Document) for an unusually long period of time before dropping below 150 mV. The substack delta voltage began to trend upward shortly after on-orbit operations began at approximately two hours Mission Elapsed Time. FC purges were ineffective at stopping the trend. FC 2 was subsequently shut down and safed to prevent the possibility of a crossover condition, and multiple payloads had to be powered down. FCs 1 and 3 continued to carry the total orbiter load and performed nominally.

Post-flight failure analysis of FC 2 did not identify a root cause for the on-orbit anomaly experienced, but did identify degraded cells and verified the cell performance monitor (CPM) was functioning properly. No foreign material/contaminant was found and the most credible scenario implies an abnormal external event affected a group of cells prior to start–up. It has been hypothesized that this external event was the presence of oxygen in the oxygen side of substack 3 of the FC at a time when the FC was supposed to be inerted with helium. This event over time would cause oxidation of the nickel Electrolyte Reservoir Plate and dissolution of palladium and platinum in the anodes. Migration and plating of the palladium onto the cathode catalyst would cause high open circuit voltage once full reactants are applied to the FC.

As a result of this anomaly and failure analysis, the Launch Commit Criteria was revised to not allow launching with an FC showing similar prelaunch CPM readings. Kennedy Space Center FC purge procedures were also modified to preclude the potential for the presence of oxygen in inerted fuel cells. The program also designed and tested a fuel-cell monitoring system (FCMS) which finally provided individual cell-health monitoring capability (STS-87 first flight). If the FCMS had been available for STS-83, it may have precluded the shutdown of the FC and may have allowed the mission to complete its planned duration.

SOURCES:

Crew Accidentally Pulls Plug on Mir

Corrective Action Record

Mir | 7/17/1997 | Crew: 3

SUMMARY:

Accidental unplugging of computer power cable led to loss of attitude control and loss of power.

EVENT DESCRIPTION:

The Progress M-35 supply spacecraft was used to reorient the Mir to restore nominal solar array power generation, recharge flight batteries, and subsequently restore Mir attitude control functions.

SOURCES:

Mir Loses all power after accident

ISS, Increment 2-4 | 4/2001-3/2002 | Crew: 3

SUMMARY:

Freon 218 leaked from SM AC.

EVENT DESCRIPTION:

During ISS Increments 2-4, which spanned from April 2001 until March 2002, Freon 218 leaked from the Service Module air conditioner.

Freon 218, a coolant fluid used in the air conditioning system, was found in cabin air quality samples after Zvezda was activated. The concentration of the Freon increased slowly once detected, but then rapidly as time passed. Peak concentrations reached over 600 mg/m3.

SOURCES:

Cabin Air Quality

ISS, Increment 17 | 4/30/2008 | Crew: 3

SUMMARY:

Freon 218 leaked from SM AC.

EVENT DESCRIPTION:

On April 30, 2008 Freon 218 leaked from the Service Module air conditioner. The Russian [BMP] (Russian Microimpurities Removal System) was modified to allow for faster removal of the Freon 218.

SOURCES:

ISS Status Report

STS-41D | 6/26/1984 | Crew: 6 | Related or Recurring event

SUMMARY:

EVENT DESCRIPTION:

SOURCES:

LAUNCH/GROUND

SUBORBITAL FLIGHTS

RESEARCH FACILITY

ATMOSPHERIC FLIGHTS

LANDING & POSTLANDING

View Emergency Systems & Crew Survival Capabilities

Hide Emergency Systems & Crew Survival Capabilities

Events in which deficiencies workmanship or process controls compromised crew safety and/or mission success.

TPS Entry Events

(1981-2003)

Mir Collision Events

1994-1997

Fire/Overheating Events

(1971-2008)

Docking Anomalies

Soyuz Landing Events

(1967-1993)

Ascent Debris:

Other debris events

have occurred on:

Late Release Orbiter

Tyvek Covers

ISS Cargo Mission Failures
2011-2016

On-pad Abort Events (1984-93)

*toxic byproducts released

STS-91

6/2/1998

Soyuz TM-9

2/11/1990

STS-112

10/7/2002

STS-41D

6/26/1984

Apollo 1 (AS-204)

1/27/1967

8/24/11

Progress M-12M (44P)

STS-114

5/26/2006

Apollo 13

4/13/1970

STS-104

7/2001

STS-83

4/6/1997

STS-9

12/8/1983

STS-2

11/12/1981

Soyuz 15

8/28/1974

Mir

6/25/1997

Mir

8/30/1994

Mir

1/14/1994

STS-6, 4/83, Crew: 4*

STS-51D

4/19/1985

STS-1

4/14/1981

Other significant STS TPS anomalies:

STS-6, 41B, 51G, 27*, 28, 40. 42, 45

*Most severe tile damage to date.

STS-9

12/8/1983

Soyuz 1

4/24/67

Apollo I (AS-204) | 1/27/1967 | Crew: 3 | Loss of Crew

SUMMARY:

Crew cabin fire (electrical short + high pressure O2 atmosphere).

EVENT DESCRIPTION:

All three crew members were lost.

Factors contributing to this accident include:

- Failure to identify the test as hazardous

- Inward-opening hatch which could not be opened during periods of increased cabin pressure

- Inadequate ground safety procedures and emergency equipment

- Last-minute changes to operational test procedures

- Unsatisfactory communications overall

- Lack of control of combustible materials

- Deficiencies in engineering, workmanship, and quality control

SOURCES:

STS-112 | 10/7/2002 | Crew: 6

SUMMARY:

T-0 umbilical issues resulted in none of the system A pyrotechnic charges firing.

EVENT DESCRIPTION:

All connectors and electrical circuits were inspected and tested, but no root cause was identified to explain the anomaly.

SOURCES:

Soyuz TM-9 | 2/11/1990 | Crew: 2

SUMMARY:

DM insulation torn loose on ascent; contingency EVA repair.

EVENT DESCRIPTION:

If the capsule cooled down, it would allow condensation to form inside the capsule and cause electrical systems to fail.
The partially detached blankets could interfere with the infrared vertical sensor which is required to orient the module for re-entry.
Exposure to space could cause a failure of the explosive bolts that bind the service module to the descent module.
The heat shield could be compromised by direct space exposure.
An Extravehicular Activity (EVA) to repair the blankets could inflict further damage.

A rescue mission with a cosmonaut aboard Soyuz-TM 10 was considered, but not executed. The temperature of TM-9 was stabilized by the Mir directing it into alignment with the sun.

SOURCES:

STS-91 | 6/2/1998 | Crew: 6

SUMMARY:

Main engine pressure chamber sensor failed. If it occurred later, logic error may have triggered at RTLS.

EVENT DESCRIPTION:

SOURCES:

Apollo 13 | 4/13/1970 | Crew: 3 | Loss of Mission

SUMMARY:

Explosion due to electrical short. Loss of O2 and EPS.

EVENT DESCRIPTION:

SOURCES:

Soyuz 15 | 8/28/1974 | Crew: 2 | Loss of Mission | Related or Recurring event

SUMMARY:

Failed to dock with Salyut 3 due to Igla system malfunction.

EVENT DESCRIPTION:

The Soyuz 15 mission launched on August 26, 1974. Its primary mission was to dock to the Saylut 3 military space station to conduct the second phase of crewed operations aboard the Salyut 3 space station. However, docking to the Salyut 3 space station was unsuccessful due to the failure of the Igla rendezvous system and the inability to complete docking in manual mode. Due to this inability to dock, as well as spacecraft battery power limitations, the Soyuz crew was forced to abandon the mission and return to Earth within two days of launch. Gyroscope problems nearly prevented orientation of the spacecraft for the de-orbit burn. After landing, the crew was recovered on August 28, 1974.

The state commission found that the Soyuz Igla docking system needed serious modifications which could not be completed before the Salyut 3 space station decayed beyond a useable orbit. Therefore, the planned Soyuz 16 spacecraft became unnecessary to the program. (It was later flown as Soyuz 20 to a civilian Salyut station, even though it exceeded its two-year rated storage life.)

SOURCES:

Soyuz 15

Related or Recurring event

In addition to three overheating/fire events on the ISS and two significant events on Mir in 1997 and 1998, other overheating/fire events also occurred on:

Mir (October 1994) (A)

STS-40 (June 1991) (B)

STS-35 (December 1990) (C)

STS-28 (August 1989) (D)

STS-6 (April 1983) (E)

Salyut 7 (September 1982) (F)

Salyut 6 (1979) (G)

Salyut 1 (June 1971) (H)

SOURCES:

Progress Collision with Spektr

Mir | 6/25/1997 | Mir Crew: 3 | Loss of Mission | Related or Recurring event

SUMMARY:

Progress M-34 collided with Mir. Spektr pressure shell ruptured. Spektr module isolated. Cables through hatchway impeded hatch closing.

Mir Crew: 3

Loss of Element

EVENT DESCRIPTION:

SOURCES:

Michael Foale

Mir-Progress Collision with Spektr

Mir | 8/30/1994 | Crew: Soyuz 2, Mir 3 | Related or Recurring event

SUMMARY:

Soyuz TM-17 collided twice with Mir during undocking.

Collision

EVENT DESCRIPTION:

SOURCES:

Soyuz 1 | 4/24/1967 | Crew: 1 | Loss of Crew | Related or Recurring event

SUMMARY:

Main and reserve parachutes failed.

Crew: 1

EVENT DESCRIPTION:

One cosmonaut was lost.

SOURCES:

STS-9 | 12/8/1983 | Crew: 6

SUMMARY:

A. Two APUs caught fire during rollout.

B. GPC failed on touchdown.

C. Incorrect flight control rechannelization on rollout.

EVENT DESCRIPTION:

SOURCES:

Related or Recurring event

Other Thermal Protection System Damage Events

In addition to the Thermal Protection System (TPS) damage on STS-1, STS-51D, and STS-107, the following Space Shuttle flights experienced TPS damage:

STS-6 (April 1983)

STS-41B (February 1984)

STS-51G (June 1985)

STS-27 (December 1988)

STS-28 (August 1989)

STS-40 (June 1991)

STS-42 (January 1992)

STS-45 (March 1992)

Additional information can be found in the reports linked below.

SOURCES:

STS-1 | 4/14/1981 | Crew: 2 | Related or Recurring event

SUMMARY:

Right-hand main landing gear door warped due to entry heating.

EVENT DESCRIPTION:

SOURCES:

STS-51D | 4/19/1985 | Crew: 7 | Related or Recurring event

SUMMARY:

TPS burn-through on left outboard elevon.

EVENT DESCRIPTION:

The post-flight inspection of the Thermal Protection System (TPS) revealed that significant damage occurred during landing on April 19, 1985.

SOURCES:

Mir | 8/30/1994 | Mir Crew: 2 | Related or Recurring event

SUMMARY:

Progress M-24 collided with Mir during second docking attempt.

Collision

EVENT DESCRIPTION:

SOURCES:

STS-2 | 11/21/1981 | Crew: 2 | Minimum Duration Flight | Crew Injury

SUMMARY:

Failure of fuel cell resulted in a MDF being declared. The fuel cell failure also resulted in hydrogen in the drinking water leading to crew dehydration.

EVENT DESCRIPTION:

SOURCES:

Oral History Report

STS-9 | 12/8/1983 | Crew: 6

SUMMARY:

Two GPCs failed during reconfiguration for entry. One GPC could not be recovered.

EVENT DESCRIPTION:

On December 8, 1983 about five hours prior to the planned landing time, the orbiter's General Purpose Computer (GPC) 1 failed when the primary Reaction Control System jets were fired. About six minutes later GPC 2 also failed, leaving the orbiter in free drift for approximately five minutes before GPC 3 was brought online in OPS 3 entry mode (GPC 3 had been freeze dried for on-orbit operations). Attempts to bring GPC 1 back online were unsuccessful, and it was powered down.

Although problems had occurred, GPC 2 was reinitialized and placed back online, and GPCs 2, 3, 4, and 5 were configured for entry. This off-nominal configuration led to further problems, and delayed the landing time by about eight hours. Entry was set up without GPC 1, and upon landing GPC 2 failed again. Particle Impact Noise Detection testing was instituted to screen out any contamination of the GPC boards, and a spare GPC was flown for several flights after STS-9, but was later dropped as a requirement.

SOURCES:

STS-83 | 4/6/1997 | Crew: 7 | Loss of Mission

SUMMARY:

Failure of fuel cell number 2 resulted in MDF being declared. The 15-day mission was shortened to 3 days.

EVENT DESCRIPTION:

SOURCES:

Corrective Action Record

STS-104 | 7/2001 | Crew: 5

SUMMARY:

EMU battery leaked hazardous KOH. Discovered during EMU checkout.

EVENT DESCRIPTION:

During the first pre-extravehicular activity checkout of the July 2001 flight, an increased capacity extravehicular mobility unit (space suit) battery was discovered to have leaked hazardous potassium hydroxide. The leakage resulted in potassium hydroxide deposits on the contamination control cartridge, the water tank structure, and other locations on the primary life support system of the space suit.

SOURCES:

STS-114 | 5/26/2006 | Crew: 7

SUMMARY:

Bird strike on External Tank.

Loss of foam from External Tank PAL ramp.

TPS gap filers protruding. Removed during third mission EVA.

Missing O-ring resulted in ejection of one of two NSIs, compromising the ET forward separation bolt function and damaging secondary structure and a thermal blanket.

EVENT DESCRIPTION:

STS-114 encountered four close-call events.

Bird-strike on external tank (ET).
During the July 26, 2005 launch of Discovery on flight STS-114, a vulture soaring around the launch pad impacted the shuttle's ET after liftoff. A bird-strike at a critical point on the shuttle could cause catastrophic damage to the vehicle since the average weight of a vulture is three to five pounds. As a preventative measure, a bird abatement program was implemented to limit the possibility of a future bird-strike on liftoff. One aspect of the program was to remove "roadkill" around the Kennedy Space Center, eliminating an easy food source for vultures. Noise deterrents were tried but had little effect on the vultures. The radar tracking of birds was also implemented.
Loss of foam from External Tank Protuberance Air Load (PAL) ramp.
At T+127.1 seconds foam debris from the ET PAL ramp was seen coming off the ET. The PAL ramps on the liquid hydrogen and liquid oxygen tanks were eliminated on STS-121 and subsequent flights.
Thermal Protection System (TPS) gap fillers protruding. Removed during third extravehicular activity (EVA).
Protruding gap fillers were discovered on the lower forward fuselage during the rendezvous pitch maneuver with the photography of the bottom of the vehicle. Concerns associated with potential early boundary layer tripping and excessive aerodynamic heating during re-entry prompted the decision to remove both gap fillers via EVA. During EVA 3, both gap fillers were successfully removed. Post-flight inspections identified nine additional protruding gap fillers. The gap filler installation process was reviewed and modified.
During post-flight inspection it was discovered that a NASA Standard Initiator (NSI) in one of the two orbiter external tank forward attach shear bolt pressure cartridges had been ejected. Black soot from pyrotechnic combustion residue covered the local surrounding area and a small crack in the secondary structure was observed. The ejected NSI damaged the secondary structure panel (approximately 1 inch long crack) and burned the thermal blankets in the vicinity. The most probable cause of the NSI ejection was a missing O-ring (vendor process escape) between the NSI and pressure cartridge which allowed hot combustion gasses to leak past, erode, and subsequently eject the NSI. The missing O-ring and subsequent combustion gas leakage reduced the probability of successful orbiter external tank forward attachment bolt shear (fracturing was successful). The NSI relies on combustion gas pressure to fracture the forward attach bolt and separate the orbiter from the external tank once on-orbit. Failure to safely separate the orbiter from the external tank would result in loss of crew and vehicle. The ejected NSI could have also damaged the crew cabin pressure shell, located near the forward attach shear bolt, possibly resulting in a cabin air leak requiring an emergency crew return and loss of mission. Mandatory inspection of NSI O-rings during installation / assembly of forward attach shear bolt pressure cartridges was implemented after STS-114.

SOURCES:

Progress M-12M | 8/24/2011 | Crew: 0 | Loss of Mission

SUMMARY:

Anomaly in fuel pressurization system led to shutdown of 3rd stage engine. Vehicle failed to reach orbit.

EVENT DESCRIPTION:

On the August 24, 2011 flight of Progress M-12M (44P) an anomaly in the fuel pressurization system led to the shutdown of the third stage engine. The engine shutdown resulted in the vehicle failing to reach orbit and crashing in the Altai Mountains.

A root cause has yet to be conclusively determined. A blockage of the third stage fuel lines is believed to be the leading cause due to manufacturing and processing.

Progress is an uncrewed vehicle which uses the same third stage rocket segment as the crewed Soyuz capsule.

SOURCES:

News Report

STS-41D | 6/26/1984 | Crew: 6 | Related or Recurring event

SUMMARY:

EVENT DESCRIPTION:

SOURCES:

Loss of Crew

Crew Injury/Illness and/or Loss of Vehicle or Mission

Related or Recurring event

LAUNCH/GROUND

SUBORBITAL FLIGHTS

RESEARCH FACILITY

ATMOSPHERIC FLIGHTS

LANDING & POSTLANDING

View Workmanship/Process Controls

Hide Workmanship/Process Controls

Events in which budget and/or schedule pressure had a significant, adverse affect on risk-based decision making and crew safety. Program management and support organizations should be sensitive to and recognize when schedule and/or budget pressure are significantly compromising crew safety and mission success.

TPS Entry Events

(1981-2003)

Soyuz Landing Events

(1967-1993)

(1981-96)

SRB Seal Events

STS-51L (Challenger)

1/28/1986

Other SRB gas seal anomalies:

STS-2, 6, 41B, 41C, 41D, 51C, 51D, 51B, 51G, 51F, 51I, 51J, 61A, 61B, 61C, 42, 70, 71, 78

Apollo 1 (AS-204)

1/27/1967

Soyuz 1

4/23/1967

STS-107 (Columbia)

2/1/2003

STS-108

12/7/2001

Soyuz 1

4/24/67

Apollo I (AS-204) | 1/27/1967 | Crew: 3 | Loss of Crew

SUMMARY:

Crew cabin fire (electrical short + high pressure O2 atmosphere).

EVENT DESCRIPTION:

All three crew members were lost.

Factors contributing to this accident include:

- Failure to identify the test as hazardous

- Inward-opening hatch which could not be opened during periods of increased cabin pressure

- Inadequate ground safety procedures and emergency equipment

- Last-minute changes to operational test procedures

- Unsatisfactory communications overall

- Lack of control of combustible materials

- Deficiencies in engineering, workmanship, and quality control

SOURCES:

Other SRB Seal Events | Related or Recurring event

SRB gas sealing anomalies have also occurred on:

STS-2 November 12, 1981

STS-6 April 4, 1983

STS-11 (STS-41B) February 3,1984

STS-41C April 6,1984

STS-41D August 30, 1984

STS-51C January 24,1985

STS-51D April 12, 1985

STS-51B April 29, 1985

STS-51G June 17,1985

STS-51F July 29, 1985

STS-51I August 27, 1985

STS-51J October 3, 1985

STS-61A October 30, 1985

STS-61B November 26,1985

STS-61C January 12, 1986

STS-42 January 22, 1992

STS-71 June 27, 1995

STS-70 July 13, 1995

STS-78 June 20, 1996

SOURCES:

STS-51L (Challenger) | 1/28/1986 | Crew: 7 | Loss of Crew | Related or Recurring event

SUMMARY:

SRB seal failure.

EVENT DESCRIPTION:

Seventy-four seconds into flight, the Space Shuttle Challenger broke up.

All seven crew members were lost.

SOURCES:

Soyuz 1 | 4/24/1967 | Crew: 1 | Loss of Crew | Related or Recurring event

SUMMARY:

Main and reserve parachutes failed.

Crew: 1

EVENT DESCRIPTION:

One cosmonaut was lost.

SOURCES:

STS-108 | 12/7/2001 | Crew: 7

SUMMARY:

Violation of minimum landing weather requirements.

EVENT DESCRIPTION:

SOURCES:

Meteorology Report

Entry FDO Post Flight

STS-107 (Columbia) | 2/1/2003 | Crew: 1 | Loss of Crew | Related or Recurring event

SUMMARY:

TPS damage from ascent debris strike resulted in loss of crew and vehicle on entry. Similar bipod ramp foam loss occurred on STS-7, STS-32, STS-50, STS-52, STS-62, and STS-112.

EVENT DESCRIPTION:

Damage to the Thermal Protection System from a debris strike on ascent resulted in the loss of crew and vehicle on entry on February 1, 2003.

Seven crew members were lost.

SOURCES:

Soyuz 1 | 4/23/1967 | Crew: 1 | Loss of Mission

SUMMARY:

Failures in attitude control and electrical power systems resulted in a loss of mission. The launch of the intended docking target, Soyuz 2, was scrubbed.

EVENT DESCRIPTION:

SOURCES:

Loss of Crew

Crew Injury/Illness and/or Loss of Vehicle or Mission

Related or Recurring event

LAUNCH/GROUND

SUBORBITAL FLIGHTS

RESEARCH FACILITY

ATMOSPHERIC FLIGHTS

LANDING & POSTLANDING

View Budget/Schedule

Hide Budget/Schedule

Events in which system redundancy/failure tolerance, or lack thereof, mitigated or compromised crew safety and/or mission success. Where feasible, redundancy should be incorporated to the design of all critical functions which could result in loss of crew or primary mission objective if the function were to fail during the mission. This includes instrumentation used to control critical functions and/or make critical decisions during the mission and common cause events where a single failure resulted in loss of two or more redundant strings.

Fire/Overheating Events

(1971-2008)

Soyuz Landing Events

(1967-1993)

(1981-96)

SRB Seal Events

*toxic byproducts released

STS-91

6/2/1998

STS-51L (Challenger)

1/28/1986

STS-51F

7/29/1985

Soyuz 18-1(18a)

4/5/1975

Apollo 12

11/14/1969

STS-112

10/7/2002

STS-117

6/8/2007

STS-114

5/26/2006

STS-93

7/23/1999

SpaceShipOne 14P

5/13/2004

ISS, Increment 15

6/10-18/2007

ISS, Increment 2

4/24/2001

STS-83

4/6/1997

STS-44

11/24/1991

STS-9

12/8/1983

STS-2

11/12/1981

Soyuz 33

4/12/1979

Soyuz 1

4/23/1967

Gemini 8

3/16-17/1966

STS-6, 4/83, Crew: 4*

Mercury MA-6

2/20/1962

STS-9

12/8/1983

Apollo 15

8/7/1971

Soyuz 1

4/24/67

STS-112 | 10/7/2002 | Crew: 6

SUMMARY:

T-0 umbilical issues resulted in none of the system A pyrotechnic charges firing.

EVENT DESCRIPTION:

All connectors and electrical circuits were inspected and tested, but no root cause was identified to explain the anomaly.

SOURCES:

Apollo 12 | 11/14/1969 | Crew: 3

SUMMARY:

Lightning strike on ascent.

EVENT DESCRIPTION:

During the Apollo 12 launch on November 14, 1969 lightning struck the spacecraft.

At 11:22am, T+36 seconds, the crew saw a bright light.

At T+52 seconds (13,000 feet) lightning struck the vehicle and the Inertial Measurement Unit platform tumbled.

Using power from the Battery Relay Bus, the crew reconnected the Fuel Cells to Main Bus A and B, and reconnected the inverters to AC Bus 1 and 2. The mission continued.

SOURCES:

Soyuz 18-1(18a) | 4/5/1975 | Crew: 2 | Loss of Vehicle/Mission

SUMMARY:

EVENT DESCRIPTION:

One crew member suffered internal injuries from the high-g re-entry and downhill fall and never flew again.

SOURCES:

STS-51F | 7/29/1985 | Crew: 7 | Abort to Orbit

SUMMARY:

Temperature sensor problems resulted in SSME1 shutdown at T+5:45.

EVENT DESCRIPTION:

On July 29, 1985 at T+5:43, both temperature sensors for the Space Shuttle Main Engine (SSME) 1 high pressure fuel turbopump showed readings exceeding the redline limit. This resulted in a premature shutdown of SSME 1 and declaration of an Abort to Orbit condition, the first in program history. At T+8:13, one of the two temperature sensors on SSME 3 indicted a high reading, but auto-shutdown was inhibited to assure STS-51F achieved an acceptable orbit.

These events were a result of confirmed instrumentation failures. The temperature sensors were removed for engineering analysis following the flight, and a new configuration sensor was used on subsequent engines.

SOURCES:

STS-51L (Challenger) | 1/28/1986 | Crew: 7 | Loss of Crew | Related or Recurring event

SUMMARY:

SRB seal failure.

EVENT DESCRIPTION:

Seventy-four seconds into flight, the Space Shuttle Challenger broke up.

All seven crew members were lost.

SOURCES:

STS-91 | 6/2/1998 | Crew: 6

SUMMARY:

Main engine pressure chamber sensor failed. If it occurred later, logic error may have triggered at RTLS.

EVENT DESCRIPTION:

SOURCES:

STS-93 | 7/23/1999 | Crew: 5

SUMMARY:

At T+5 a short on AC1 Phase A

resulted in loss of SSME1 Controller A and SSME3 Controller B.

SSME3 H2 leak: early LOX depletion and shutdown.

EVENT DESCRIPTION:

STS-93 encountered two close-call events.

At T+5 seconds a short on AC1 Phase A resulted in the loss of Space Shuttle Main Engine (SSME) 1 Controller A and SSME 3 Controller B.
Approximately five seconds into the launch of STS-93 on July 23, 1999 a momentary short occurred on AC1 phase A. A current spike in excess of 20 amps combined with a voltage drop from 114 to 21 volts alternating current was observed on AC1 phase, phase A. Coincident with the short, the SSME 1 (center) controller A and SSME 3 (right) controller B failed. The short was isolated to a damaged wire in the port wire tray at the mid-body bay. Analysis of the damaged wire indicated the damage resulted from a single mechanical event. It was initially suspected the damage was caused by vibration-induced chaffing against the head of a torque-set screw. At the short location, the screw head showed obvious signs of arcing, and wire damage at a second screw head (about 2 inches away) was observed, but there was no evidence of arcing.
Main Engine 3 hydrogen leak: early liquid oxygen depletion and shutdown.
An early SSME shutdown resulted in a 16 feet per second under speed condition. The early shutdown was traced to a hydrogen leak in the number three main engine nozzle. Post-flight inspection revealed ruptures in the engine nozzle tubes caused by an impact of a loose liquid oxygen post deactivation pin. The liquid hydrogen leak resulted in the controller compensating for fuel loss with additional liquid oxygen flow, at 16 feet per second under speed. The deactivation pin was expelled during the engine start as pressure built in the liquid oxygen cavity (five seconds after engine start). Design changes were implemented to eliminate the need for deactivation pins.

SOURCES:

Mercury MA-6 | 2/20/1962 | Crew: 1

SUMMARY:

False landing-bag indicator light led to entry with retropack in place as a precaution.

EVENT DESCRIPTION:

On February 20, 1962 a sensor indicated the heatshield was in an unlatched condition while still in orbit. If the sensor's reading were true, the heatshield could have been lost during entry, resulting in the loss of the vehicle and crew. Because the indictor said the heatshield had been dropped to the landing position, entry procedures were changed to eliminate the jettisoning of the retropack. The retropack was used as a redundant heatshield hold-down device to keep the heatshield in place. The straps holding the retropack burned through during entry, but it was thought that the aerodynamic pressure would hold the heatshield in place. After landing it was discovered that the indicator was incorrect and that the heatshield had not been dropped to the landing position.

SOURCES:

An American in Orbit

Related or Recurring event

In addition to three overheating/fire events on the ISS and two significant events on Mir in 1997 and 1998, other overheating/fire events also occurred on:

Mir (October 1994) (A)

STS-40 (June 1991) (B)

STS-35 (December 1990) (C)

STS-28 (August 1989) (D)

STS-6 (April 1983) (E)

Salyut 7 (September 1982) (F)

Salyut 6 (1979) (G)

Salyut 1 (June 1971) (H)

SOURCES:

SpaceShipOne 14P | 5/13/2004 | Crew: 1

SUMMARY:

Flight computer unresponsive. Recovered by rebooting.

EVENT DESCRIPTION:

Due to the loss of avionics during the boost, the trajectory was not precise. The avionics malfunction was traced to a dimmer, a small electrical component.

SOURCES:

Soyuz 1 | 4/24/1967 | Crew: 1 | Loss of Crew | Related or Recurring event

SUMMARY:

Main and reserve parachutes failed.

Crew: 1

EVENT DESCRIPTION:

One cosmonaut was lost.

SOURCES:

Apollo 15 | 8/7/1971 | Crew: 3

SUMMARY:

Landed with only 2 of 3 parachutes.

EVENT DESCRIPTION:

The investigation was divided into three areas which were likely causes of the parachute failure.

The forward heat shield was suspected because of the close proximity to the spacecraft flight path during the period when the failure occurred.

A broken riser/suspension-line connector link was found on the recovered parachute, indicating the possibility of broken links in the failed chute.

SOURCES:

LUNAR EXPLORATION CONCLUDED: to the Mountains of the Moon

Main Parachute Failure

Crew Debrief

Apollo 15 Anomaly Report

STS-9 | 12/8/1983 | Crew: 6

SUMMARY:

A. Two APUs caught fire during rollout.

B. GPC failed on touchdown.

C. Incorrect flight control rechannelization on rollout.

EVENT DESCRIPTION:

SOURCES:

Gemini 8 | 3/16-3/17/1966 | Crew: 2 | Emergency De-orbit | Loss of Mission

SUMMARY:

Stuck thruster caused loss of control and led to 1st U.S. emergency
de-orbit.

EVENT DESCRIPTION:

SOURCES:

Soyuz 1 | 4/23/1967 | Crew: 1 | Loss of Mission

SUMMARY:

Failures in attitude control and electrical power systems resulted in a loss of mission. The launch of the intended docking target, Soyuz 2, was scrubbed.

EVENT DESCRIPTION:

SOURCES:

Soyuz 33 | 4/12/1979 | Crew: 2 | Loss of Mission

SUMMARY:

Main engine anomaly caused final rendezvous abort.

EVENT DESCRIPTION:

SOURCES:

Soyuz 33

STS-2 | 11/21/1981 | Crew: 2 | Minimum Duration Flight | Crew Injury

SUMMARY:

Failure of fuel cell resulted in a MDF being declared. The fuel cell failure also resulted in hydrogen in the drinking water leading to crew dehydration.

EVENT DESCRIPTION:

SOURCES:

Oral History Report

STS-9 | 12/8/1983 | Crew: 6

SUMMARY:

Two GPCs failed during reconfiguration for entry. One GPC could not be recovered.

EVENT DESCRIPTION:

SOURCES:

STS-44 | 11/24/1991 | Crew: 6 | Minimum Duration Flight

SUMMARY:

Failure of IMU 2 caused MDF to be declared. 10-day mission shortened to 7 days.

EVENT DESCRIPTION:

Failure of Inertial Measurement Unit (IMU) number 2 on November 24, 1991 caused minimum duration flight to be declared. The 10-day mission was shortened to seven days. In an attempt to recover normal operation of the IMU, it was placed in standby, operate, and then power cycled. These actions were not successful. Failure of this IMU invoked a flight rule requiring minimum duration flight for loss of one IMU.

Post-flight troubleshooting in the Inertial Systems Laboratory at Johnson Space Center isolated the problem to a failed computer interface card. This card converts analog acceleration signals into digital signals. The failed card was sent to the manufacturer for further analysis which revealed that a filter capacitor (C14), located within a chopper-stabilized amplifier hybrid component (U12) in the Z-accelerator channel, had shorted. This short circuit caused a bond wire from U12 pin 9 to the card case to fuse open.

SOURCES:

STS-83 | 4/6/1997 | Crew: 7 | Loss of Mission

SUMMARY:

Failure of fuel cell number 2 resulted in MDF being declared. The 15-day mission was shortened to 3 days.

EVENT DESCRIPTION:

SOURCES:

Unlikely failures triggered computer shutdown

Corrective Action Record

ISS, Increment 2 | 4/24/2001 | Crew: 10

SUMMARY:

Failure of all U.S. command and control computers on ISS.

EVENT DESCRIPTION:

On April 24, 2001 the ISS Command and Control (C&C) Multiplexer/Demultiplexer (MDM)-1 suffered hard drive errors that resulted in C&C-1 going offline.C&C-2 automatically switched from backup to primary mode, but suffered hard drive errors. C&C-3 was brought online but also failed. This resulted in complete loss of command and control to the United States orbital segment. C&C-2 was restored and placed into operation in primary mode. Flight controllers were able to uplink critical C&C software into the dynamic random access memory of C&C-3. C&C-3 was declared operational except the hard drive. C&C-1 was replaced with an identical payload computer.

If the MDMs were unrecoverable, the failure could have resulted in the loss of the United States orbital segment.

SOURCES:

STS-100 NASA Facts

ISS PART MER Record 368

FMEA-CIL 18249

FMEA-CIL 7882

ISS, Increment 15 | 6/10-6/18/2007 | Crew: 10

SUMMARY:

Power switch failures caused loss of ISS propulsive attitude control capability.

EVENT DESCRIPTION:

On June 10-18 2007 Russian computers that provide ISS propulsive attitude control [ТВМ], and Russian segment command and control capability [ЦВМ], experienced multiple automatic and manual restarts. ISS attitude control was maintained by the docked shuttle (Atlantis STS-117/13A) while Russian specialists and US teams worked to restore consistent power to the computers. The Russian cosmonauts were able to re-establish two of three computers on both systems ([ТВМ], [ЦВМ]) by June 18 after bypassing the secondary power circuitry to provide a continuous “ON” command.

Troubleshooting later identified the root cause to be an electrical short in the line resulting from corrosion of cabling within the Command Acquisition (Processing) Unit [БОК3] which monitors power. The short caused a power-off command to be passed to all six computers. The corrosion was presumed to be caused by increased humidity resulting from the close proximity of an air separator to the [БОК3]. The [БОК3] was subsequently relocated to a separate compartment.

If the Russian computers were unrecoverable, the failure could have resulted in the loss of ISS attitude control and loss of ISS.

SOURCES:

ISS Status Report STS-117MCC Status Report STS-117 NASA Facts

RS Knowledge Base Event 2369 ISS Part Record 2511

STS-114 | 5/26/2006 | Crew: 7

SUMMARY:

Bird strike on External Tank.

Loss of foam from External Tank PAL ramp.

TPS gap filers protruding. Removed during third mission EVA.

Missing O-ring resulted in ejection of one of two NSIs, compromising the ET forward separation bolt function and damaging secondary structure and a thermal blanket.

EVENT DESCRIPTION:

STS-114 encountered four close-call events.

Bird-strike on external tank (ET).
During the July 26, 2005 launch of Discovery on flight STS-114, a vulture soaring around the launch pad impacted the shuttle's ET after liftoff. A bird-strike at a critical point on the shuttle could cause catastrophic damage to the vehicle since the average weight of a vulture is three to five pounds. As a preventative measure, a bird abatement program was implemented to limit the possibility of a future bird-strike on liftoff. One aspect of the program was to remove "roadkill" around the Kennedy Space Center, eliminating an easy food source for vultures. Noise deterrents were tried but had little effect on the vultures. The radar tracking of birds was also implemented.
Loss of foam from External Tank Protuberance Air Load (PAL) ramp.
At T+127.1 seconds foam debris from the ET PAL ramp was seen coming off the ET. The PAL ramps on the liquid hydrogen and liquid oxygen tanks were eliminated on STS-121 and subsequent flights.
Thermal Protection System (TPS) gap fillers protruding. Removed during third extravehicular activity (EVA).
Protruding gap fillers were discovered on the lower forward fuselage during the rendezvous pitch maneuver with the photography of the bottom of the vehicle. Concerns associated with potential early boundary layer tripping and excessive aerodynamic heating during re-entry prompted the decision to remove both gap fillers via EVA. During EVA 3, both gap fillers were successfully removed. Post-flight inspections identified nine additional protruding gap fillers. The gap filler installation process was reviewed and modified.
During post-flight inspection it was discovered that a NASA Standard Initiator (NSI) in one of the two orbiter external tank forward attach shear bolt pressure cartridges had been ejected. Black soot from pyrotechnic combustion residue covered the local surrounding area and a small crack in the secondary structure was observed. The ejected NSI damaged the secondary structure panel (approximately 1 inch long crack) and burned the thermal blankets in the vicinity. The most probable cause of the NSI ejection was a missing O-ring (vendor process escape) between the NSI and pressure cartridge which allowed hot combustion gasses to leak past, erode, and subsequently eject the NSI. The missing O-ring and subsequent combustion gas leakage reduced the probability of successful orbiter external tank forward attachment bolt shear (fracturing was successful). The NSI relies on combustion gas pressure to fracture the forward attach bolt and separate the orbiter from the external tank once on-orbit. Failure to safely separate the orbiter from the external tank would result in loss of crew and vehicle. The ejected NSI could have also damaged the crew cabin pressure shell, located near the forward attach shear bolt, possibly resulting in a cabin air leak requiring an emergency crew return and loss of mission. Mandatory inspection of NSI O-rings during installation / assembly of forward attach shear bolt pressure cartridges was implemented after STS-114.

SOURCES:

STS-117 | 6/8/2007 | Crew: 7

SUMMARY:

Thermal blanket damage. EVA performed to repair damage.

EVENT DESCRIPTION:

On June 8, 2007 during ascent, a thermal blanket covering the port orbital maneuvering system (OMS) pod was damaged.

An unplanned extravehicular activity, a high risk operation, was performed to repair the damaged blanket, so the blanket could effectively prevent potential damage to the vehicle from heating during entry. Failure of the thermal protection during entry could have resulted in overheating of the OMS and catastrophic structural failure of the vehicle and loss of crew.

The blanket was repaired by inserting pins between the thermal blanket and the surrounding shuttle tiles. A surgical stapler was also used in fastening the two thermal blankets together.

SOURCES:

STS-117 MCC Status Report

STS-117 NASA Facts

STS-117 EVA

Loss of Crew

Crew Injury/Illness and/or Loss of Vehicle or Mission

Related or Recurring event

LAUNCH/GROUND

SUBORBITAL FLIGHTS

RESEARCH FACILITY

ATMOSPHERIC FLIGHTS

LANDING & POSTLANDING

View Critical System Redundancy/Failure Tolerance

Hide Critical System Redundancy/Failure Tolerance

Events in which inadequate or improper materials selection and/or testing compromised crew safety and/or mission success. Includes events where inadequate materials off-gassing and/or compatibility testing was performed to identify incompatibility, off-gassing, or performance issues.

TPS Entry Events

(1981-2003)

(1981-96)

SRB Seal Events

Other SRB gas seal anomalies:

STS-2, 6, 41B, 41C, 41D, 51C, 51D, 51B, 51G, 51F, 51I, 51J, 61A, 61B, 61C, 42, 70, 71, 78

Apollo 1 (AS-204)

1/27/1967

STS-93

7/23/1999

ISS, Increment 5&6

mid 2002-2/03

ISS

8/2001

Soviet Altitude

Chamber O2 Fire

3/23/1961

Navy Chamber

11/17/1962

Other significant STS TPS anomalies:

STS-6, 41B, 51G, 27*, 28, 40. 42, 45

*Most severe tile damage to date.

STS-51D

4/19/1985

Apollo 15

8/7/1971

Apollo I (AS-204) | 1/27/1967 | Crew: 3 | Loss of Crew

SUMMARY:

Crew cabin fire (electrical short + high pressure O2 atmosphere).

EVENT DESCRIPTION:

All three crew members were lost.

Factors contributing to this accident include:

- Failure to identify the test as hazardous

- Inward-opening hatch which could not be opened during periods of increased cabin pressure

- Inadequate ground safety procedures and emergency equipment

- Last-minute changes to operational test procedures

- Unsatisfactory communications overall

- Lack of control of combustible materials

- Deficiencies in engineering, workmanship, and quality control

SOURCES:

Other SRB Seal Events | Related or Recurring event

SRB gas sealing anomalies have also occurred on:

STS-2 November 12, 1981

STS-6 April 4, 1983

STS-11 (STS-41B) February 3,1984

STS-41C April 6,1984

STS-41D August 30, 1984

STS-51C January 24,1985

STS-51D April 12, 1985

STS-51B April 29, 1985

STS-51G June 17,1985

STS-51F July 29, 1985

STS-51I August 27, 1985

STS-51J October 3, 1985

STS-61A October 30, 1985

STS-61B November 26,1985

STS-61C January 12, 1986

STS-42 January 22, 1992

STS-71 June 27, 1995

STS-70 July 13, 1995

STS-78 June 20, 1996

SOURCES:

STS-93 | 7/23/1999 | Crew: 5

SUMMARY:

At T+5 a short on AC1 Phase A

resulted in loss of SSME1 Controller A and SSME3 Controller B.

SSME3 H2 leak: early LOX depletion and shutdown.

EVENT DESCRIPTION:

STS-93 encountered two close-call events.

At T+5 seconds a short on AC1 Phase A resulted in the loss of Space Shuttle Main Engine (SSME) 1 Controller A and SSME 3 Controller B.
Approximately five seconds into the launch of STS-93 on July 23, 1999 a momentary short occurred on AC1 phase A. A current spike in excess of 20 amps combined with a voltage drop from 114 to 21 volts alternating current was observed on AC1 phase, phase A. Coincident with the short, the SSME 1 (center) controller A and SSME 3 (right) controller B failed. The short was isolated to a damaged wire in the port wire tray at the mid-body bay. Analysis of the damaged wire indicated the damage resulted from a single mechanical event. It was initially suspected the damage was caused by vibration-induced chaffing against the head of a torque-set screw. At the short location, the screw head showed obvious signs of arcing, and wire damage at a second screw head (about 2 inches away) was observed, but there was no evidence of arcing.
Main Engine 3 hydrogen leak: early liquid oxygen depletion and shutdown.
An early SSME shutdown resulted in a 16 feet per second under speed condition. The early shutdown was traced to a hydrogen leak in the number three main engine nozzle. Post-flight inspection revealed ruptures in the engine nozzle tubes caused by an impact of a loose liquid oxygen post deactivation pin. The liquid hydrogen leak resulted in the controller compensating for fuel loss with additional liquid oxygen flow, at 16 feet per second under speed. The deactivation pin was expelled during the engine start as pressure built in the liquid oxygen cavity (five seconds after engine start). Design changes were implemented to eliminate the need for deactivation pins.

SOURCES:

Chapter 10 - Dead Cosmonauts

Altitude Chamber O2 Fire | 3/23/1961 | Crew: 1 | Loss of Crew

SUMMARY:

Alcohol wipe hit hot plate and started fire in oxygen-rich test chamber.

EVENT DESCRIPTION:

SOURCES:

Navy Chamber | 11/17/1962 | Crew: 4 | Crew Injury (4)

SUMMARY:

Fire started in a 100% oxygen environment at 5 psi. Four officers injured.

EVENT DESCRIPTION:

On November 17, 1962 four Navy officers were injured, two seriously, when a fire started in the altitude chamber they were occupying in a 20 day experiment at the U.S. Navy Air Crew Equipment Laboratory as part of a NASA atmosphere validation program.

The chamber contained 100% oxygen at 5 psi. The fire started when one officer changed a light bulb in an energized 24 volt DC light fixture. One wire in the fixture became disconnected resulting in arcing. A cotton towel was used in an attempt to smoother the fire. The towel caught fire, and the flames spread to the officers' clothes.

SOURCES:

Apollo 1 Hearing

Apollo 15 | 8/7/1971 | Crew: 3

SUMMARY:

Landed with only 2 of 3 parachutes.

EVENT DESCRIPTION:

The investigation was divided into three areas which were likely causes of the parachute failure.

The forward heat shield was suspected because of the close proximity to the spacecraft flight path during the period when the failure occurred.

A broken riser/suspension-line connector link was found on the recovered parachute, indicating the possibility of broken links in the failed chute.

SOURCES:

LUNAR EXPLORATION CONCLUDED: to the Mountains of the Moon

Main Parachute Failure

Crew Debrief

Apollo 15 Anomaly Report

STS-51D | 4/19/1985 | Crew: 7

SUMMARY:

Right brake failed (locked up) causing blowout of inboard tire and significant damage to outboard tire.

Crew: 7

EVENT DESCRIPTION:

The corrective action includes the following standard procedures to prevent heat soak-back:

1. Brake-on velocity between 140 and 120 knots.

2. Deceleration rate between 8 and 10 ft/sec2.

3. Deceleration rate reduced to 6 ft/sec2 at 40 knots. If brake-on velocity exceeds 140 knots, continue 8 to 10 ft/sec2 deceleration.

SOURCES:

Related or Recurring event

Other Thermal Protection System Damage Events

In addition to the Thermal Protection System (TPS) damage on STS-1, STS-51D, and STS-107, the following Space Shuttle flights experienced TPS damage:

STS-6 (April 1983)

STS-41B (February 1984)

STS-51G (June 1985)

STS-27 (December 1988)

STS-28 (August 1989)

STS-40 (June 1991)

STS-42 (January 1992)

STS-45 (March 1992)

Additional information can be found in the reports linked below.

SOURCES:

ISS | 8/2001 | Crew: 3

SUMMARY:

Extremely high methanol levels in FGB air sample.

EVENT DESCRIPTION:

During August 2001 Functional Cargo Block [FGB] air samples contained extremely high methanol levels. The source of the methanol was never identified.

SOURCES:

Air Quality Assessment

ISS, Increment 5&6 | mid 2002-2/03 | Crew: 3-10

SUMMARY:

Formaldehyde periodically exceeded long-term limits.

EVENT DESCRIPTION:

During ISS Increments 5 and 6, which spanned from mid-2002 until February 2003, formaldehyde levels onboard the station periodically exceeded the long-term limits.

SOURCES:

Loss of Crew

Crew Injury/Illness and/or Loss of Vehicle or Mission

Related or Recurring event

LAUNCH/GROUND

SUBORBITAL FLIGHTS

RESEARCH FACILITY

ATMOSPHERIC FLIGHTS

LANDING & POSTLANDING

View Materials Selection

Hide Materials Selection

Events in which inadequate requirements definition or validation resulted in inadequate design or operations procedures, resulting in hardware damage/failure during the mission. Inadequate requirements definition or validation can result in unplanned/unforeseen systems anomalies or failures during the missions. Examples include inadequate definitions of induced environments resulting in actual environments exceeding hardware certification limits. Requirements should be comprehensive, well defined, and validated by test and/or analysis.

TPS Entry Events

(1981-2003)

Docking Anomalies

Ascent Debris:

Other debris events

have occurred on:

Late Release Orbiter

Tyvek Covers

On-pad Abort Events (1984-93)

STS-51F

7/29/1985

Apollo 13

4/11/1970

Apollo 12

11/14/1969

STS-112

10/7/2002

STS-61C

1/6/1986

STS-41D

6/26/1984

Soyuz T-10-1(T-10a)

9/26/1983

Other on-pad abort events:

STS-51F, STS-55, STS-51, STS-68

STS-1

4/12/1981

Apollo 1 (AS-204)

1/27/1967

Gemini 6

12/12/1965

STS-114

5/26/2006

STS-95

10/29/1998

X-15 3-65-97

11/15/1967

STS-133

2/26/2011

STS-130

2/10/2010

Soyuz TM-25

8/17/1997

Other significant STS TPS anomalies:

STS-6, 41B, 51G, 27*, 28, 40. 42, 45

*Most severe tile damage to date.

Gemini 6 | 12/12/1965 | Crew: 2

SUMMARY:

EVENT DESCRIPTION:

There was a main engine shutdown during the attempted launch on December 12,1965.

About 1.5 seconds after main engine ignition, an electrical plug fell from the vehicle and accidentally started a clock that normally starts during vehicle liftoff.

A successful launch occurred three days later.

SOURCES:

Go Back to Go

Apollo I (AS-204) | 1/27/1967 | Crew: 3 | Loss of Crew

SUMMARY:

Crew cabin fire (electrical short + high pressure O2 atmosphere).

EVENT DESCRIPTION:

All three crew members were lost.

Factors contributing to this accident include:

- Failure to identify the test as hazardous

- Inward-opening hatch which could not be opened during periods of increased cabin pressure

- Inadequate ground safety procedures and emergency equipment

- Last-minute changes to operational test procedures

- Unsatisfactory communications overall

- Lack of control of combustible materials

- Deficiencies in engineering, workmanship, and quality control

SOURCES:

STS-1 | 4/12/1981 | Crew: 2

SUMMARY:

SRB ignition pressure wave caused TPS and structural damage.

EVENT DESCRIPTION:

During the April 12, 1981 launch of STS-1, a higher than expected solid rocket booster ignition pressure wave caused damage to both the thermal protection system and structure.

SOURCES:

STS-61C | 1/6/1986 | Crew: 7

SUMMARY:

System configuration errors resulted in inadvertent drain back of 14,000 lbs of LOX prelaunch, which would have resulted in a Trans-Atlantic Abort Landing.

EVENT DESCRIPTION:

SOURCES:

MER Report | Anomaly PR | LO2 Temerature Probe Incident | Mission Report | Close Call

STS-112 | 10/7/2002 | Crew: 6

SUMMARY:

T-0 umbilical issues resulted in none of the system A pyrotechnic charges firing.

EVENT DESCRIPTION:

All connectors and electrical circuits were inspected and tested, but no root cause was identified to explain the anomaly.

SOURCES:

Apollo 12 | 11/14/1969 | Crew: 3

SUMMARY:

Lightning strike on ascent.

EVENT DESCRIPTION:

During the Apollo 12 launch on November 14, 1969 lightning struck the spacecraft.

At 11:22am, T+36 seconds, the crew saw a bright light.

At T+52 seconds (13,000 feet) lightning struck the vehicle and the Inertial Measurement Unit platform tumbled.

Using power from the Battery Relay Bus, the crew reconnected the Fuel Cells to Main Bus A and B, and reconnected the inverters to AC Bus 1 and 2. The mission continued.

SOURCES:

Apollo 13 | 4/11/1970 | Crew: 3

SUMMARY:

2nd stage center engine shutdown due to pogo oscillations.

EVENT DESCRIPTION:

SOURCES:

STS-51F | 7/29/1985 | Crew: 7 | Abort to Orbit

SUMMARY:

Temperature sensor problems resulted in SSME1 shutdown at T+5:45.

EVENT DESCRIPTION:

SOURCES:

Other On Pad Aborts | Related or Recurring events

On pad aborts have also occurred on:

SOURCES:

STS-51F Mission Report

STS-51 Mission Report

STS-55 Mission Report

STS-68 Mission Report

STS-95 | 10/29/1998 | Crew: 7 | Related or Recurring event

SUMMARY:

Drag chute door separated during launch and impacted main engine bell.

EVENT DESCRIPTION:

SOURCES:

STS-95 Mission Archives

Soyuz T-10-1 (T-10a) | 9/26/1983 | Crew: 2 | Loss of Vehicle/Mission | Related or Recurring event

SUMMARY:

Pad booster fire/explosion. Capsule Escape System used.

Crew: 2

EVENT DESCRIPTION:

Twenty seconds later ground control activated the escape system by radio command. By this time the booster was engulfed in flames.

Seconds after the escape system activated, the booster exploded, destroying the launch complex.

SOURCES:

MIR Hardware Heritage

NASA Astonauts on Soyuz

Hypersonic Before the Shuttle

X-15 3-65-97 | 11/15/1967 | Crew: 1 | Loss of Crew

SUMMARY:

Electrical short and crew error led to loss of control at 230,000 feet. First U.S. spaceflight fatality.

EVENT DESCRIPTION:

This was the first United States spaceflight fatality.

SOURCES:

X-15 Inflight Breakup

Micheal J. Adams

Related or Recurring event

Other Thermal Protection System Damage Events

In addition to the Thermal Protection System (TPS) damage on STS-1, STS-51D, and STS-107, the following Space Shuttle flights experienced TPS damage:

STS-6 (April 1983)

STS-41B (February 1984)

STS-51G (June 1985)

STS-27 (December 1988)

STS-28 (August 1989)

STS-40 (June 1991)

STS-42 (January 1992)

STS-45 (March 1992)

Additional information can be found in the reports linked below.

SOURCES:

Soyuz TM-25 | 8/17/1997 | Crew: 3

SUMMARY:

Landing rockets fired at heat shield separation rather than at landing.

EVENT DESCRIPTION:

On August 17, 1997 the landing rockets on Soyuz TM-25 fired during heat shield separation rather than during landing. This failure resulted in a harder landing than normal.

The Mir with the docked Soyuz was experiencing high humidity levels in the atmosphere. Water condensing on the connectors in the Soyuz electrical box controlling the circuit probably caused a short circuit, which caused the rockets to fire when the system was armed at heat shield physical separation. Changes were made to either seal the connectors or separate the connectors to prevent a short from applying electrical power to the rockets when the system is armed.

The design has two primary types of inhibits. One inhibit consists of three mechanical switches that physically disconnect the firing circuit when the heat shield is attached. These switches are spring loaded and move approximately 20 mm as the heat shield is deployed to close the firing circuit. A minimum of two out of three switches must be closed for the initiating system to function. In addition to these mechanical inhibits, logic in the electronics prevents the ignition command from being sent until after the heat shield is deployed. Nominally the soft landing motors are ignited when the gamma ray altitude/velocity sensor detects proximity to the ground. The system automatically initiates either four or six motors depending on the velocity. Each motor has 1 kg of propellant and burns for approximately 0.1 to 0.14 seconds.

SOURCES:

Soyuz TM-25

STS-130 | 2/10/2010 | Crew: 6 | Related or Recurring event

SUMMARY:

Experienced significant misalignment between orbiter and ISS during post-capture free drift due to gravity-gradient-induced motion.

EVENT DESCRIPTION:

On February 10, 2010 there were significant oscillations between the orbiter and ISS on STS-130 during final ring retraction, requiring an additional 34 minutes in free drift to complete docking. Similar oscillations were observed during STS-133 docking.

Post-flight analysis from the STS-130 event indicated that the oscillations were caused by gravity gradient effects on the integrated vehicle stack (ISS/Shuttle) resulting in misalignment of the final docking ring and loss of the “RING ALIGN” indication. When the “RING ALIGN” indication is lost, the fixers are released, resulting in large misalignments.

Concern for ISS longeron shadowing and lack of data resulted in the Missions Operations Directorate not accepting the recommendation to rely on the fixers to maintain the alignment even after loss of “RING ALIGN” until after STS-133.

SOURCES:

JOP Minutes

STS-133 | 2/26/2011 | Crew: 6 | Related or Recurring event

SUMMARY:

Experienced significant misalignment between orbiter and ISS during post-capture free drift due to gravity-gradient-induced motion.

EVENT DESCRIPTION:

On February 26, 2011 STS-133 experienced significant misalignment between the orbiter and the ISS during post-capture free drift due to gravity-gradient-induced motion.

There were significant oscillations between the orbiter and ISS on STS-133 during final ring retraction. The orbiter tipped approximately 10 degrees in pitch and four degrees in roll while ring retraction was paused. The time from contact to hardmate took 50 minutes.

Post-flight analysis of STS-133 docking operations raised several concerns, including vehicle-to-vehicle clearance, mechanism-to-mechanism contact, ISS free drift risks (longeron shadowing risk), timeline impacts, and the lack of a good integrated analysis tool.

At the Generic Joint Operations Panel on April, 6 2011 it was stated that the docking mechanism fixers will be used to maintain alignment during retraction. Engineering and safety agreed with the recommendation. The docking procedures were updated prior to STS-134/ULF6.

SOURCES:

JOP Minutes

STS-114 | 5/26/2006 | Crew: 7

SUMMARY:

Bird strike on External Tank.

Loss of foam from External Tank PAL ramp.

TPS gap filers protruding. Removed during third mission EVA.

Missing O-ring resulted in ejection of one of two NSIs, compromising the ET forward separation bolt function and damaging secondary structure and a thermal blanket.

EVENT DESCRIPTION:

STS-114 encountered four close-call events.

Bird-strike on external tank (ET).
During the July 26, 2005 launch of Discovery on flight STS-114, a vulture soaring around the launch pad impacted the shuttle's ET after liftoff. A bird-strike at a critical point on the shuttle could cause catastrophic damage to the vehicle since the average weight of a vulture is three to five pounds. As a preventative measure, a bird abatement program was implemented to limit the possibility of a future bird-strike on liftoff. One aspect of the program was to remove "roadkill" around the Kennedy Space Center, eliminating an easy food source for vultures. Noise deterrents were tried but had little effect on the vultures. The radar tracking of birds was also implemented.
Loss of foam from External Tank Protuberance Air Load (PAL) ramp.
At T+127.1 seconds foam debris from the ET PAL ramp was seen coming off the ET. The PAL ramps on the liquid hydrogen and liquid oxygen tanks were eliminated on STS-121 and subsequent flights.
Thermal Protection System (TPS) gap fillers protruding. Removed during third extravehicular activity (EVA).
Protruding gap fillers were discovered on the lower forward fuselage during the rendezvous pitch maneuver with the photography of the bottom of the vehicle. Concerns associated with potential early boundary layer tripping and excessive aerodynamic heating during re-entry prompted the decision to remove both gap fillers via EVA. During EVA 3, both gap fillers were successfully removed. Post-flight inspections identified nine additional protruding gap fillers. The gap filler installation process was reviewed and modified.
During post-flight inspection it was discovered that a NASA Standard Initiator (NSI) in one of the two orbiter external tank forward attach shear bolt pressure cartridges had been ejected. Black soot from pyrotechnic combustion residue covered the local surrounding area and a small crack in the secondary structure was observed. The ejected NSI damaged the secondary structure panel (approximately 1 inch long crack) and burned the thermal blankets in the vicinity. The most probable cause of the NSI ejection was a missing O-ring (vendor process escape) between the NSI and pressure cartridge which allowed hot combustion gasses to leak past, erode, and subsequently eject the NSI. The missing O-ring and subsequent combustion gas leakage reduced the probability of successful orbiter external tank forward attachment bolt shear (fracturing was successful). The NSI relies on combustion gas pressure to fracture the forward attach bolt and separate the orbiter from the external tank once on-orbit. Failure to safely separate the orbiter from the external tank would result in loss of crew and vehicle. The ejected NSI could have also damaged the crew cabin pressure shell, located near the forward attach shear bolt, possibly resulting in a cabin air leak requiring an emergency crew return and loss of mission. Mandatory inspection of NSI O-rings during installation / assembly of forward attach shear bolt pressure cartridges was implemented after STS-114.

SOURCES:

STS-41D | 6/26/1984 | Crew: 6 | Related or Recurring event

SUMMARY:

EVENT DESCRIPTION:

SOURCES:

Loss of Crew

Crew Injury/Illness and/or Loss of Vehicle or Mission

Related or Recurring event

LAUNCH/GROUND

SUBORBITAL FLIGHTS

RESEARCH FACILITY

ATMOSPHERIC FLIGHTS

LANDING & POSTLANDING

View Requirements Definition/Validation

Hide Requirements Definition/Validation

Events in which system override capability, or lack thereof, prevented or could have prevented loss of crew or loss of mission. This includes the ability to inhibit automated functions. Designs should incorporate override capabilities for all critical autonomous functions which, if lost or malfunctioning, could result in loss of crew or primary mission objective.

Mir Collision Events

1994-1997

Fire/Overheating Events

(1971-2008)

Docking Anomalies

On-pad Abort Events (1984-93)

*toxic byproducts released

Soyuz 18-1(18a)

4/5/1975

Apollo 12

11/14/1969

Soyuz T-10-1(T-10a)

9/26/1983

SpaceShipOne 16P

9/29/2004

Apollo 14

1/31/1971

Soyuz TMA-18 (22S)

9/23/2010

Soyuz 23

10/16/1976

Soyuz 21

8/24/1976

Soyuz 1

4/23/1967

Gemini 8

3/16-17/1966

Mercury MA-9

5/16/1963

Soyuz T-8

4/22/1983

Skylab 2

5/26/1973

Soyuz 10

4/23/1971

Soyuz 15

8/28/1974

Mir

8/30/1994

Mir

1/14/1994

ISS, 10/10/08, Crew: 3

ISS, 9/18/06, Crew: 3*

ISS, 3/05, Crew: 2

Mir*

2/26/1998

Mir*

2/24/1997

Mir, 10/94, Crew: 6

STS-40, 6/91, Crew: 7*

STS-35, 12/90, Crew: 7*

STS-28, 8/89, Crew: 5*

STS-6, 4/83, Crew: 4*

Salyut 7, 9/82, Crew: 3

Salyut 6, 1979, Crew: 3

Salyut 1, 6/71, Crew: 3

Soyuz TM-5

9/6/1988

Skylab 4

2/8/1974

Gemini 4

6/7/1965

Voskhod 2

3/19/1965

Mercury MA-7

5/24/1962

Mercury MA-6

2/20/1962

Mercury MA-7

5/24/1962

Apollo 12 | 11/14/1969 | Crew: 3

SUMMARY:

Lightning strike on ascent.

EVENT DESCRIPTION:

During the Apollo 12 launch on November 14, 1969 lightning struck the spacecraft.

At 11:22am, T+36 seconds, the crew saw a bright light.

At T+52 seconds (13,000 feet) lightning struck the vehicle and the Inertial Measurement Unit platform tumbled.

Using power from the Battery Relay Bus, the crew reconnected the Fuel Cells to Main Bus A and B, and reconnected the inverters to AC Bus 1 and 2. The mission continued.

SOURCES:

Soyuz 18-1(18a) | 4/5/1975 | Crew: 2 | Loss of Vehicle/Mission

SUMMARY:

EVENT DESCRIPTION:

One crew member suffered internal injuries from the high-g re-entry and downhill fall and never flew again.

SOURCES:

Apollo 14 | 1/31/1971 | Crew: 3

SUMMARY:

Multiple failed docking attempts. Contingency procedures developed to mitigate risk of recurring docking anomaly. Docking successful.

EVENT DESCRIPTION:

On January 31, 1971 six docking attempts were unsuccessful following translunar injection. On the seventh try the command module pilot was told to fire thrusters to hold the command module to the lunar module while the docking probe was retracted. The docking capture latches were triggered to fire the probe-retract pyrotechnic, and docking was successful. After docking, the drogue and probe were examined by the crew and appeared normal. No other issues arose with the docking mechanisms.

The most likely cause of the docking issue was a piece of debris or ice on the docking probe from rain water entering the boost shroud the day before launch. The mission would have been No-Go for lunar module separation and landing if a backup procedure for docking and retracting the docking probe in an emergency had not been developed.

SOURCES:

Mission Anomaly Report

Mercury MA-6 | 2/20/1962 | Crew: 1

SUMMARY:

False landing-bag indicator light led to entry with retropack in place as a precaution.

EVENT DESCRIPTION:

SOURCES:

An American in Orbit

Soyuz T-10-1 (T-10a) | 9/26/1983 | Crew: 2 | Loss of Vehicle/Mission | Related or Recurring event

SUMMARY:

Pad booster fire/explosion. Capsule Escape System used.

Crew: 2

EVENT DESCRIPTION:

Twenty seconds later ground control activated the escape system by radio command. By this time the booster was engulfed in flames.

Seconds after the escape system activated, the booster exploded, destroying the launch complex.

SOURCES:

MIR Hardware Heritage

NASA Astonauts on Soyuz

Mercury 7 Description & Analysis

Mercury MA-7 | 5/24/1962 | Crew: 1

SUMMARY:

RCS depletion at 80,000 ft.

EVENT DESCRIPTION:

SOURCES:

Soyuz 15 | 8/28/1974 | Crew: 2 | Loss of Mission | Related or Recurring event

SUMMARY:

Failed to dock with Salyut 3 due to Igla system malfunction.

EVENT DESCRIPTION:

SOURCES:

Soyuz 15

Related or Recurring event

In addition to three overheating/fire events on the ISS and two significant events on Mir in 1997 and 1998, other overheating/fire events also occurred on:

Mir (October 1994) (A)

STS-40 (June 1991) (B)

STS-35 (December 1990) (C)

STS-28 (August 1989) (D)

STS-6 (April 1983) (E)

Salyut 7 (September 1982) (F)

Salyut 6 (1979) (G)

Salyut 1 (June 1971) (H)

SOURCES:

Mir | 8/30/1994 | Crew: Soyuz 2, Mir 3 | Related or Recurring event

SUMMARY:

Soyuz TM-17 collided twice with Mir during undocking.

Collision

EVENT DESCRIPTION:

SOURCES:

Mercury MA-9 | 5/16/1963 | Crew: 1 | Manual Entry

SUMMARY:

Electrical faults caused loss of some systems and need to perform manual entry. Also experienced high PPCO2 levels in suit during entry operations.

EVENT DESCRIPTION:

The malfunction during re-entry on MA-9 was traced to two connectors in an electrical amplifier.

SOURCES:

SpaceShipOne 16P | 9/29/2004 | Crew: 1

SUMMARY:

Uncommanded vehicle roll. Control regained prior to apogee.

EVENT DESCRIPTION:

SOURCES:

Mercury 7 Description and Analysis

SpaceShipOne Flight 16P

Mercury MA-7 | 5/24/1962 | Crew: 1

SUMMARY:

Pitch horizon scanner failed, resulting in manual entry and off-target landing. Delayed crew recovery.

EVENT DESCRIPTION:

SOURCES:

Voskhod 2 | 3/19/1965 | Crew: 2

SUMMARY:

Automatic descent system malfunctioned. Issues with manual entry resulted in off-target, rough terrain landing. Delayed crew recovery.

EVENT DESCRIPTION:

SOURCES:

The Nighmare of Voskhod 2

Gemini 4 | 6/7/1965 | Crew: 2

SUMMARY:

Erroneous entry data uplinked; crew manually corrected entry flight profile.

EVENT DESCRIPTION:

SOURCES:

Four Days and a "Walk"

Gemini 4 Computer Report

Skylab 4 | 2/8/1974 | Crew: 3

SUMMARY:

Incorrect circuit breakers opened, resulting in the loss of the automatic control.

EVENT DESCRIPTION:

The failure to orient the heat shield forward would have caused loss of crew.

SOURCES:

Skylab 4 Technical Debrief (see page 9-26)

Soyuz TM-5 | 9/6/1988 | Crew: 2

SUMMARY:

Two de-orbit attempts failed. Crew confined to DM due to OM being jettisoned prior to 1st de-orbit attempt. Crew prevented erroneous firing of SM separation pyrotechnics.

EVENT DESCRIPTION:

SOURCES:

Related or Recurring event

On February 24, 1997 after replacing the Solid Fuel Oxygen Generator (SFOG) cartridge a fire ignited onboard the Mir space station. After becoming aware of the fire, the crew donned oxygen mask and gathered fire extinguishers. The flames blocked the emergency path to one of the docked Soyuz capsules preventing half of the 6 member crew from evacuating if the need arose. The foam fire extinguishers eventually doused the flames before an evacuation of the station was needed. The proximate cause of the fire is thought to be a piece of latex glove that contaminated the Lithium Perchlorate canister during ground operations.

SOURCES:

The Fire - News Release

Russian Space Fires

Related or Recurring event

On February 26, 1998 the Russian Micropurification Unit [BMP] onboard the Russian Mir space station overheated and caused the level of carbon dioxide to climb to health-threatening levels.

SOURCES:

Related or Recurring event

On October 10, 2008 the crew reported smoke and odor emitting from the Russian condensate water processor unit [SRV-K]. The equipment housing was hot. When the air quality was tested using the Compound Specific Analyzer-Combustible Products (CSA-CP), carbon dioxide was found at five parts per million and acid gases, hydrogen chloride and hydrogen cyanide, were zero. The [SRV-K] was powered off and replaced, which resolved the issue.

On September 18, 2006 the crew reported smoke and a solvent smell. The Elektron was found to have released toxic byproducts. The CSA-CP registered carbon dioxide at seven parts per million and hydrogen chloride and hydrogen cyanide above one part per million.

In March 2005 an electrical odor was traced to a lamp on the Service Module.

SOURCES:

Skylab 1-2 Technical Debrief

Soyuz 10 | 4/23/1971 | Crew: 3 | Loss of Mission | Related or Recurring event

SUMMARY:

Automatic docking system failed. Manual docking with Salyut not achieved.

EVENT DESCRIPTION:

SOURCES:

Soyuz 10

Skylab 2 | 5/26/1973 | Crew: 3 | Related or Recurring event

SUMMARY:

Multiple failed automatic docking attempts resulted in manual docking to Skylab.

EVENT DESCRIPTION:

The failure to dock would have resulted in the loss of Skylab due to the inability to perform critical repairs.

SOURCES:

Skylab 2

Living and Working in Space: A History of Skylab

Soyuz T-8 | 4/22/1983 | Crew: 3 | Loss of Mission | Related or Recurring event

SUMMARY:

Loss of rendezvous antenna prevented docking.

EVENT DESCRIPTION:

On April 20, 1983 the loss of rendezvous antenna prevented docking.

The Soyuz rendezvous radar antenna failed to deploy properly before docking attempts with Salyut 7. Several attitude control maneuvers at high rates were attempted but failed to swing the boom out. A rendezvous using only an optical sight and ground radar inputs for guidance was attempted, but was aborted when it was thought the vehicles were closing too fast. No further attempts were made to dock with the station.

The post-flight inquiry later discovered that the antenna was torn off when the Soyuz payload shroud separated.

SOURCES:

Mir | 8/30/1994 | Mir Crew: 2 | Related or Recurring event

SUMMARY:

Progress M-24 collided with Mir during second docking attempt.

Collision

EVENT DESCRIPTION:

SOURCES:

Gemini 8 | 3/16-3/17/1966 | Crew: 2 | Emergency De-orbit | Loss of Mission

SUMMARY:

Stuck thruster caused loss of control and led to 1st U.S. emergency
de-orbit.

EVENT DESCRIPTION:

SOURCES:

Soyuz 1 | 4/23/1967 | Crew: 1 | Loss of Mission

SUMMARY:

Failures in attitude control and electrical power systems resulted in a loss of mission. The launch of the intended docking target, Soyuz 2, was scrubbed.

EVENT DESCRIPTION:

SOURCES:

Soyuz 21 | 8/24/1976 | Crew: 2

SUMMARY:

Separation from Salyut failed; ground command succeeded in opening latches.

EVENT DESCRIPTION:

SOURCES:

Soyuz 23 | 10/16/1976 | Crew: 2 | Loss of Mission

SUMMARY:

Mission Abort due to docking failure.

EVENT DESCRIPTION:

The Soyuz 23 mission launched on October 14, 1976. Its primary mission was to dock to the Saylut 5 space station to conduct crewed operations aboard the station. However, docking to the Salyut 5 space station was unsuccessful due to the failure of the automated rendezvous system. Sensors used by the automatic system indicated an incorrect lateral velocity, causing unnecessary firing of the thrusters during rendezvous. The automatic system was turned off, but no fuel reserves remained for a manual docking attempt with the Salyut 5. The mission was aborted, and low spacecraft battery reserves forced the crew to return early. Upon re-entry/landing the capsule landed in a lake during a snow storm, delaying crew recovery (see Soyuz 23 landing event). The crew was recovered on October 16, 1976.

SOURCES:

Close Call Awareness Paper

Soyuz 23

Soyuz TMA-18 (22S) | 9/23/2010 | Crew: Soyuz 3, ISS 3

SUMMARY:

First attempt to separate from ISS failed; ISS crew succeeded in bypassing faulty sensor.

EVENT DESCRIPTION:

The first attempt to separate the Soyuz from ISS on September 23, 2010 failed. A hatch sensor on the Poisk docking port of the Zvezda module prevented hooks on the Poisk side from opening.

SOURCES:

News Report

Loss of Crew

Crew Injury/Illness and/or Loss of Vehicle or Mission

Related or Recurring event

LAUNCH/GROUND

SUBORBITAL FLIGHTS

RESEARCH FACILITY

ATMOSPHERIC FLIGHTS

LANDING & POSTLANDING

View Override Capability for Autonomous Systems

Hide Override Capability for Autonomous Systems

Events in which inadequate or improper configuration management for hardware/software/procedures compromised crew safety and/or mission success. Also includes events where configuration changes were not thoroughly assessed for impacts to system, interfacing system(s), and/or planned operations.

STS-110

STS-109

STS-108

4/8/2002

3/1/2002

12/5/2001

Apollo 13

4/13/1970

Apollo ASTP

7/24/1975

STS-110 | 14/8/2002 | Crew: 7

STS-109 | 13/1/2002 | Crew: 7

STS-108 | 12/5/2001 | Crew: 7

SUMMARY:

Incorrect adjustments to the controller software resulted in SSME underperformance.

EVENT DESCRIPTION:

SOURCES:

STS-111 SSME FRR

STS-111 FRR

Close Call Presentation

Apollo 13 | 4/13/1970 | Crew: 3 | Loss of Mission

SUMMARY:

Explosion due to electrical short. Loss of O2 and EPS.

EVENT DESCRIPTION:

SOURCES:

Apollo Soyuz Mission Anomaly Report

Apollo ASTP | 7/24/1975 | Crew: 3 | Crew Injury

SUMMARY:

N2O4 in crew cabin. Crew hospitalized for 2 weeks.

EVENT DESCRIPTION:

SOURCES:

Asynchronicity

July 24th - Last Splash

Loss of Crew

Crew Injury/Illness and/or Loss of Vehicle or Mission

Related or Recurring event

LAUNCH/GROUND

SUBORBITAL FLIGHTS

RESEARCH FACILITY

ATMOSPHERIC FLIGHTS

LANDING & POSTLANDING

View Configuration Management/Change Integration

Hide Configuration Management/Change Integration

Events in which maintenance/repair capability, or lack thereof, mitigated or could have mitigated risk to crew safety and mission success. This includes cases where improper design or maintenance procedures resulted in damage to the vehicle (collateral damage). Where feasible, contingency maintenance/repair capability should be incorporated into the design of all critical functions which could result in loss of crew or primary mission objective if the function were to fail or degrade during the mission. Training requirements, human factors, and potential for collateral damage should be considered when developing nominal and contingency maintenance plans/procedures.

Soyuz TM-9

2/11/1990

STS-117

6/8/2007

STS-114

5/26/2006

STS-93

7/23/1999

ISS, Increment 15

6/10-18/2007

ISS, Increment 13

8/2006

ISS, Increment 2

4/24/2001

Apollo 11

7/21/1969

Soyuz TM-9 | 2/11/1990 | Crew: 2

SUMMARY:

DM insulation torn loose on ascent; contingency EVA repair.

EVENT DESCRIPTION:

If the capsule cooled down, it would allow condensation to form inside the capsule and cause electrical systems to fail.
The partially detached blankets could interfere with the infrared vertical sensor which is required to orient the module for re-entry.
Exposure to space could cause a failure of the explosive bolts that bind the service module to the descent module.
The heat shield could be compromised by direct space exposure.
An Extravehicular Activity (EVA) to repair the blankets could inflict further damage.

A rescue mission with a cosmonaut aboard Soyuz-TM 10 was considered, but not executed. The temperature of TM-9 was stabilized by the Mir directing it into alignment with the sun.

SOURCES:

STS-93 | 7/23/1999 | Crew: 5

SUMMARY:

At T+5 a short on AC1 Phase A

resulted in loss of SSME1 Controller A and SSME3 Controller B.

SSME3 H2 leak: early LOX depletion and shutdown.

EVENT DESCRIPTION:

STS-93 encountered two close-call events.

At T+5 seconds a short on AC1 Phase A resulted in the loss of Space Shuttle Main Engine (SSME) 1 Controller A and SSME 3 Controller B.
Approximately five seconds into the launch of STS-93 on July 23, 1999 a momentary short occurred on AC1 phase A. A current spike in excess of 20 amps combined with a voltage drop from 114 to 21 volts alternating current was observed on AC1 phase, phase A. Coincident with the short, the SSME 1 (center) controller A and SSME 3 (right) controller B failed. The short was isolated to a damaged wire in the port wire tray at the mid-body bay. Analysis of the damaged wire indicated the damage resulted from a single mechanical event. It was initially suspected the damage was caused by vibration-induced chaffing against the head of a torque-set screw. At the short location, the screw head showed obvious signs of arcing, and wire damage at a second screw head (about 2 inches away) was observed, but there was no evidence of arcing.
Main Engine 3 hydrogen leak: early liquid oxygen depletion and shutdown.
An early SSME shutdown resulted in a 16 feet per second under speed condition. The early shutdown was traced to a hydrogen leak in the number three main engine nozzle. Post-flight inspection revealed ruptures in the engine nozzle tubes caused by an impact of a loose liquid oxygen post deactivation pin. The liquid hydrogen leak resulted in the controller compensating for fuel loss with additional liquid oxygen flow, at 16 feet per second under speed. The deactivation pin was expelled during the engine start as pressure built in the liquid oxygen cavity (five seconds after engine start). Design changes were implemented to eliminate the need for deactivation pins.

SOURCES:

Apollo 11 | 7/21/1969 | Crew: 2

SUMMARY:

Engine arm circuit breaker knob broke off. Circuit breaker successfully reset allowing ascent.

EVENT DESCRIPTION:

SOURCES: